EU – US Data Privacy Framework

Notice

Please be advised that Alter Domus Inc., Cortland Capital Market Services LLC, Alter Domus (US) LLC, Alter Domus (CA) Inc., Alter Domus Products Corp., Investors Economic Assurance, LLC, IPS Fund Services, LLC, Strata Fund Solutions, LLC, AD Carta, LLC, Alter Domus Data & Analytics Holdco (US) Inc., Alter Domus Data Solutions, Inc. and Bloomingdale Technology LLC (DE), all US entities within the Alter Domus Group (collectively, “Alter Domus US”), may collect and transfer certain personal data outside of the EU, United Kingdom (UK) and Switzerland to the United States for processing and storage as (1) part of its provision of services to clients of its subsidiaries located in the EU, particularly for the purpose of performing “know your customer” identity verification and “anti-money laundering” compliance reviews; and (2) for pure employment functions, such as, processing payroll and track time and attendance; managing worker’s compensation claims; administering and maintaining benefits, including group benefits, and retirement service and insurance; managing employee performance of job duties and conduct workplace investigations; and performing background checks on employees.

Alter Domus US is committed to complying with the EU-U.S. Data Privacy Framework (EU-US DPF), UK Extension to the EU-US DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-US DPF) (the “Framework”) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union to the United States, UK, and Switzerland. When doing so, Alter Domus processes personal data pursuant to established safeguards such as the use of EU Standard Contractual Clauses.

Alter Domus US has certified to the Department of Commerce that it adheres to the EU-US DPF, UK Extension to the EU-US DPF, and the Swiss-U.S. DPF and the Federal Trade Commission has jurisdiction over Alter Domus’s compliance with the Framework. If there is any conflict between the terms in this privacy policy regarding the EU-US DPF, UK Extension to the EU-US DPF, Swiss-US DPF, and the EU-US Data Privacy Principles (“Principles”), the Principles shall govern. To learn more about the EU-US Data Privacy program, and to view our certification, please visit https://www.dataprivacyframework.gov/s/participant-search.

Scope and limits on disclosure

In connection to the provision of services to clients, Alter Domus US may provide personal data to third parties of identity verification web-based programs. These third parties are subject to confidentiality and data security obligations in their access of said personal data. These vendors would be responsible to Alter Domus US for any misuse or unauthorized access of this personal data. Alter Domus US has in place data security and recovery systems and policies that are at or higher than industry standard for the protection of such personal data.

In connection with pure employment functions, Alter Domus US may share your data with third parties where it is necessary to administer the employment function or where Alter Domus US has another legitimate interest in doing so. These third parties are subject to confidentiality and data security obligations in their access of said personal data. These third parties would be responsible to Alter Domus US for any misuse or unauthorized access of this personal data. Alter Domus US has in place data security and recovery systems and policies that are at or higher than industry standard for the protection of such personal data.

“Third parties” includes:

• Public authorities, including tax authorities and regulatory authorities 
• Third-party service providers (including but not limited to; software providers, IT support providers, suppliers who process data on behalf of Alter Domus, and designated agents)
• Auditors
• Alter Domus clients and their advisors (for communications purposes and where AD staff act on behalf of clients)

Your personal data may also be disclosed in response to lawful requests by public authorities or by court order, which enforcement authority has jurisdiction over Alter Domus US’s compliance with the Framework.

Alter Domus US will not use or disclose personal information for purposes other than those for which it was collected, except with the consent of the individual, or as required or authorized by law. Personal information will be retained only as long as necessary for the fulfilment of those purposes.

Individual Notice and Choice

Alter Domus US does not use any automated processes to make decisions about you without human intervention. Notice to individuals regarding the personal information collected from them and how that information is used may be provided through this EU-US DPF, UK Extension to the EU-US DPF, and the Swiss-U.S. DPF Policy, other Alter Domus website notices, or other direct forms of communication with appropriate parties, such as contracts or agreements. Where necessary and appropriate, consent for personal information to be collected, used, and/or transferred may also be obtained through these same means of communication (including opt-in consent for sensitive personal information). If you wish to limit the use and disclosure of personal information in accordance with the Framework, please contact the Group Data Protection Officer at [email protected].

Onward Transfer

In cases of onward transfer to third parties of HR Data received pursuant to the Framework, Alter Domus is potentially liable. Alter Domus US shall remain liable under the Principles if its agent processes such personal information in a manner inconsistent with the Principles, unless Alter Domus US proves that it is not responsible for the event giving rise to the damage.

In the context of an onward transfer Alter Domus has responsibility for the processing of personal information it receives under the EU-US DPF, UK Extension to the EU-US DPF, and the Swiss-U.S. DPF Framework and subsequently transfers to a third party acting as an agent on its behalf. Alter Domus shall remain liable under the Principles if its agent processes such personal information in a manner inconsistent with the Principles, unless the organization proves that it is not responsible for the event giving rise to the damage.

Independent Recourse Mechanism

Individuals have the right to access their personal data. Alter Domus US commits to resolve complaints about our collection or use of your personal information. Residents of the European Union, UK and Switzerland with inquiries or complaints regarding our EU-US DPF policy should first contact David J. Evans, Group Data Protection Officer, at [email protected].

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Alter Domus US commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (UK ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF in the context of the employment relationship.

Additionally, Alter Domus US commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to the International Centre for Dispute Resolution and American Arbitration Association (“ICDR-AAA”), an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your EU-US Data Privacy Framework Principles and/or Swiss-US Data Privacy Framework Principles (“DPF Principles”) -related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://adr.org/Arbitration for more information or to file a complaint. The services of the ICDR-AAA are provided at no cost to you.

If neither Alter Domus nor our alternative dispute resolution provider resolves your complaint, you have the possibility to invoke binding arbitration through the Data Privacy Framework Panel. For more information on this option, please see Annex I of the EU-U.S. Data Privacy Framework Principles.