LV
LV
About Us Our Team Services Sustainability Contact Us

Privacy Policy

1. Terms and Definitions

1.1. AIFM – Alternative Investment Fund Manager (AIFM).

1.2. AML/CFT (Anti-Money Laundering and Countering the Financing of Terrorism) measures aimed at preventing money laundering, terrorist financing, and proliferation financing.

1.3. Audit Logs – automatically generated records documenting who accessed a system, when access occurred, what actions were performed (viewed, modified, deleted), and from which device or IP address.

1.4. GDPR (General Data Protection Regulation (EU) 2016/679) – Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation).

1.5. MFA (Multi-Factor Authentication) – an authentication method requiring two or more independent verification factors.

1.6. MLRO (Money Laundering Reporting Officer) – the person responsible for AML/CFT compliance.

1.7. PEP (Politically Exposed Person) – a natural person who is or has, within the last 12 months, held a prominent public function, as well as their family members and persons known to be closely associated with such individuals.

1.8. Beneficial Owner a natural person who ultimately owns or controls a client or on whose behalf a transaction is conducted, and who directly or indirectly owns (directly or indirectly holds at least 25% of the company's capital) or otherwise controls a legal entity, legal arrangement, or account.

1.9. Policy – this Data Protection and Privacy Policy.

2. Purpose and Scope

2.1. The purpose of this Policy is to ensure that personal data is processed in compliance with:

  • GDPR,
  • the Personal Data Processing Law of the Republic of Latvia,
  • the supervisory requirements of the Bank of Latvia applicable to Alternative Investment Fund Managers,
  • the AIFM's internal information security and IT policies.

2.2. This Policy applies to the processing of:

  • investor data,
  • beneficial owner data,
  • management board member and employee data,
  • outsourced service provider data,
  • website visitor data,
  • any other personal data processed within the scope of the AIFM's activities.

3. Data Controller

The Data Controller is:

SIA FINTERRA

Registration No.: 40203760918

Address: Citadeles iela 12, Riga, Latvia

Email for data protection matters: info@finterra.lv

4. Categories of Personal Data Processed

The AIFM processes the following categories of personal data:

4.1. Investor and Beneficial Owner Data

  • first name and surname,
  • personal identity number and/or date of birth,
  • contact information,
  • passport or identity card details,
  • country of residence,
  • beneficial ownership information,
  • sanctions and PEP screening results,
  • source of funds documentation.

4.2. Employee and Management Board Member Data

  • identification data,
  • contact information,
  • education and professional qualification details,
  • fit and proper assessment documentation,
  • conflict of interest declarations.

4.3. Website Visitor Data

  • IP address,
  • cookie data (cookie data),
  • device and browser information,
  • website usage statistics.

4.4. Outsourced Service Provider Data

  • contact information,
  • contractual information,
  • AML and PEP screening results.

5. Purposes and Legal Bases for Processing Personal Data

5.1. Employee and Management Board Member Data

Legal basis: Article 6(1)(b) GDPR – performance of a contract.

5.2. Compliance with AML/CFT and Sanctions Requirements

Legal basis:

  • Article 6(1)(c) GDPR – compliance with a legal obligation,
  • Article 9(2)(g) GDPR – substantial public interest (AML/CFT).

5.3. Compliance with Regulatory Requirements

Legal basis: Article 6(1)(c) GDPR.

5.4. Fund Administration and Accounting

Legal basis: Articles 6(1)(b) and 6(1)(c) GDPR.

5.5. Website Operation and Security

Legal basis: Article 6(1)(f) GDPR – legitimate interests.

5.6. Communication with Individuals

Legal basis: Article 6(1)(f) GDPR or Article 6(1)(a) GDPR where consent is required.

6. Data Retention Periods

The AIFM retains personal data as follows:

  • AML/CFT data – for 5 to 8 years after the termination of the business relationship,
  • contractual data – for 10 years,
  • website cookie data – in accordance with the Cookie Policy,
  • regulatory reporting data – in accordance with applicable legislation,
  • employee data – in accordance with the Labour Law of the Republic of Latvia.

7. Data Sharing and Recipients

The AIFM may disclose personal data to:

7.1. Regulatory Authorities

  • the Bank of Latvia,
  • the Financial Intelligence Unit,
  • the State Revenue Service.

7.2. Outsourced Service Providers

  • accounting service providers and/or fund administrators,
  • depositaries,
  • sanctions screening service providers,
  • IT service providers (including Microsoft 365),
  • legal advisers,
  • internal audit service providers.

All outsourced service providers:

  • comply with the GDPR,
  • ensure appropriate protection of personal data,
  • are bound by contractual confidentiality and data protection obligations,
  • may not disclose personal data to third parties without the AIFM's prior authorization.

8. Data Security

The AIFM implements appropriate technical and organizational measures, including:

  • Multi-Factor Authentication (MFA) for all users,
  • encryption (Microsoft 365),
  • audit logs,
  • access rights management,
  • data minimisation,
  • secure document storage,
  • incident management procedures.

9. Rights of Data Subjects

Data subjects have the right to:

  • access their personal data,
  • request rectification of inaccurate data,
  • request erasure (where not contrary to AML/CFT obligations),
  • request restriction of processing,
  • object to processing,
  • receive their personal data in a portable format,
  • lodge a complaint with the Data State Inspectorate of Latvia.

Within the AML/CFT framework:

  • the rights to erasure and restriction of processing may be limited where required by law.

10. Cookies

The AIFM's website may use:

  • strictly necessary cookies,
  • analytical cookies (subject to consent),
  • security cookies.

Website users may:

  • accept cookies,
  • refuse analytical cookies,
  • obtain additional information in the Cookie Policy.

11. Transfers of Personal Data Outside the EU/EEA

The AIFM does not transfer personal data outside the European Union or the European Economic Area except where:

  • such transfers are necessary through the Microsoft 365 infrastructure,
  • appropriate safeguards under Article 46 GDPR, including Standard Contractual Clauses (SCCs), are applied,
  • an adequate level of protection is ensured.

12. Personal Data Breaches

In the event of a personal data breach, the AIFM shall:

  • immediately investigate the incident,
  • notify the Data State Inspectorate within 72 hours where required,
  • notify affected data subjects where required,
  • document the incident,
  • implement corrective measures.

The incident shall be coordinated by the MLRO in cooperation with the Chief Risk Officer.

13. Contact Information for Data Protection Matters

For questions regarding personal data processing:

14. Policy Review

This Policy shall be:

  • reviewed at least annually,
  • updated following significant legislative or operational changes,
  • approved by the Management Board.

15. Document Revision History

Document Information:

  • Version No. - 1.0.,
  • Approval Date - 08.2026.,
  • Responsible Person - Management Board.