Website Privacy Notice

Introduction

JJJ Capital Management LLP and JJJ Capital Management (DIFC) Limited (together "JJJ Capital", "we", "us", "our") are committed to being transparent about how we collect and use your personal data and to meeting our obligations under data protection laws, including the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, and the Dubai International Financial Centre Data Protection Law, DIFC Law No. 5 of 2020 (the "DIFC DPL").

The purpose of this Privacy Notice is to explain how we collect, use, share and otherwise process personal data relating to visitors to our website, individuals who contact us, representatives of prospective and existing clients, investors, counterparties and service providers, business contacts and other individuals whose personal data may be collected through our website or in connection with our investment management and other business activities.

Please take time to read this Privacy Notice carefully. It is important that you fully understand how we are processing your personal data and how we are protecting your privacy.

Date of issue: October 2023
Updated: September 2026

1. Who is the Data Controller?

The controller of your personal data will generally be the JJJ Capital entity with which you interact. This will either be: JJJ Capital Management LLP, 5th Floor, Greycoat Stores, 10 Greycoat Place, London, SW1P 1SB, United Kingdom (Company number: OC445465); or JJJ Capital Management (DIFC) Limited, Index Tower, Level 4, Unit 406, DIFC, Dubai.

2. What Information is Included in this Privacy Notice?

This Privacy Notice is designed to provide you with information about:

the types of personal data we process;
the purposes and legal bases for any processing;
who we may share your personal data with;
when we may transfer your personal data internationally;
the period for which any personal data will be stored; and
the rights you have in relation to your personal data.

3. What Personal Data Do We Process About You?

We may process the following categories of personal data about you, depending on the nature of our relationship with you:

personal details such as name, job title/role, employer, gender, date of birth, and nationality;
contact details such as residential and business addresses, telephone numbers and email addresses;
identification information such as photographs, passport, Emirates ID (in the DIFC), driving licence, birth certificate, proof of address and other information required for due diligence, anti-money laundering, sanctions screening and regulatory compliance purposes;
transaction and financial information such as bank account details, source of wealth and source of funds information, tax identification numbers, tax details, information relating to assets or net worth, and financial checks (where applicable), signature, and (where applicable) your authority to act on behalf of the entity you represent;
business relationship and communications information such as records of meetings, calls, correspondence, enquiries, instructions, website submissions and other interactions with us;
website, technical and usage information such as IP addresses, browser information, cookie data, device identifiers, log-in information and information regarding your use of our website and digital services;
information relating to communications and technology systems, such as sent and received emails, telephone and audio-visual communications, call recordings, call transcripts and information generated through our use of artificial intelligence and other software tools, including tools used to record, transcribe or summarise meetings or communications;
publicly available information, such as biographical and professional information and publicly available statements, comments and opinions; and
monitoring information such as CCTV footage, visitor records and technical information relating to the use of our website, systems and services.

We may also process sensitive personal data where permitted by applicable law. This may include information relating to criminal convictions and offences (for example, where necessary for anti-money laundering, sanctions screening, fraud prevention, regulatory compliance, due diligence activities, or the establishment, exercise or defence of legal claims).

4. How Do We Collect Your Personal Data?

Directly from you: We collect personal data from you directly (electronically, in writing, or verbally). For example, you may provide personal data to us when you visit our website, contact us by email, telephone or post, complete website forms, register for events, communicate with us as a client, investor, counterparty or business contact, or otherwise interact with us in connection with our business activities.

Generated by us: We may generate personal data in the course of our relationship with you, such as records of communications, meetings, calls, transactions, due diligence processes, relationship management activities and interactions with our website. Personal data will also be generated through your use of our website, our IT and our communications systems, and through the use of AI software and tools (such as those used to automatically summarise or transcribe meetings).

From third parties: We may also receive personal data relating to you from third parties. These may include clients, investors, counterparties, service providers, regulators, governmental authorities, law enforcement agencies, credit reference agencies, and providers of due diligence, sanctions screening and anti-money laundering services. We may also obtain personal data from publicly accessible sources, such as corporate registries, industry publications, social media platforms and professional networking websites.

5. How Do We Use Your Personal Data?

We generally use your personal data to manage our relationship with you, to operate and develop our business, to provide products and services, and to comply with our legal and regulatory obligations. In particular, we use your personal data:

to respond to enquiries and requests and communicate with you;
to establish, manage and maintain relationships with clients, prospective clients, investors, counterparties, service providers and business contacts;
to support investment research and analysis activities;
to assess, onboard and administer clients, investors, counterparties and other business relationships;
to perform contractual obligations and provide products and services;
for business management, administration and planning purposes and to operate, develop and grow our business, including in connection with marketing and business development activities and any sale or restructuring of our business;
to manage and improve our website, digital services and user experience;
to analyse website usage and activity, including through cookies and analytics technologies;
to facilitate meetings, events and communications;
to manage and safeguard our IT and communications systems and to ensure network, information and cyber security;
to monitor for compliance with applicable laws and regulations and our policies and procedures, including monitoring communications where permitted by applicable law;
to complete investor due diligence questionnaires, requests for proposals and other information requests;
to conduct due diligence, anti-money laundering, sanctions screening, fraud prevention and know-your-customer checks;
to comply with legal, regulatory, tax, accounting and reporting obligations;
for establishing, exercising or defending legal claims;
for the prevention, detection and investigation of unlawful acts (including fraud); and
to operate AI and technology tools that assist with administration, communications, research, meeting management and other business activities, subject to appropriate controls and safeguards.

We may use your personal data for marketing and business development purposes where permitted by applicable law. Where required, we will provide you with appropriate choices regarding such communications, and you have the right to object to the processing of your personal data for direct marketing purposes at any time.

6. Why Do We Process Your Personal Data?

We only process personal data where the processing can be legally justified. We will usually rely on one of the following lawful bases for the processing:

for the performance of a contract, or in order to take steps at your request prior to entering into a contract: for example, to establish and manage relationships with clients, investors, counterparties and service providers, provide products and services, or otherwise fulfil our contractual obligations;
for ensuring compliance with our legal obligations: for example, to comply with applicable financial services, anti-money laundering, sanctions, fraud prevention, tax, accounting, regulatory reporting, communications monitoring and record-keeping requirements;
for our legitimate interests (or those of a third party), provided your interests and fundamental rights do not override those interests, for example:
- to manage the JJJ Capital business efficiently and effectively (for example, to operate and develop our business, support investment research and analysis, establish or defend legal claims, or to facilitate a sale or restructuring of the business);
- to keep our systems, website, devices and information secure in accordance with local law requirements to prevent fraud and ensure network, premises and information security;
- to provide information requested by our investors, trading counterparties and service providers;
- to maintain compliance with our internal policies and procedures;
- to manage and improve our website, digital services and user experience, including through the use of website analytics and cookies;
- to conduct due diligence, anti-money laundering, sanctions screening and fraud prevention activities; and
- to use publicly available information, including publicly available biographical and professional information and publicly available statements, comments and opinions, in connection with our investment research and business activities.
with your consent, in limited circumstances and where permitted by law (for example, where consent is required for certain cookies, website analytics technologies, marketing communications or the processing of particular categories of personal data). Further details about the processing of such data will be provided to you at the time such consent is sought. In such circumstances you can withdraw your consent at any time, although please note that a revocation of consent would not affect the lawfulness of any processing that has already occurred.

In the case of special category personal data or sensitive personal data (such as information about your criminal convictions), additional protections apply under data protection legislation. We therefore usually only process such data in the following circumstances and where permitted by applicable laws:

where it is necessary in order to establish, exercise or defend legal claims (or potential legal claims);
where it is necessary for reasons of substantial public interest, including to prevent fraud and unlawful acts;
where the personal data has been manifestly made public by the individual concerned; and/or
where we have your explicit consent.

7. Do We Use Automated Decision-Making?

We do not envisage that any decisions will be taken about you using solely automated means. We will notify you if this changes.

8. With Whom Might We Share Your Personal Data?

We may share your personal data with third parties, such as:

other companies and affiliates within the JJJ Capital group;
third party service providers, which may include suppliers of IT infrastructure, cloud hosting, website hosting, website analytics, communications systems, customer relationship management systems, marketing services, audio-visual communication tools, enterprise AI tools, corporate administration services and other technical, operational and professional support services;
government bodies, dispute resolution and law enforcement organisations and other regulators, including the DIFC, FCA, HMRC, law enforcement agencies and the courts;
our advisors, including accountants, auditors, lawyers and other external professional advisors;
our trading counterparties, banks, brokers, custodians, administrators, service providers and other business partners in the ordinary course of our business;
our investors and potential investors in the context of responding to due diligence questionnaires, requests for proposals, fundraising activities and investor reporting;
service providers and trading counterparties to our clients, including placement agents or distributors, brokers, banks, trading venues, clearing houses, custodians, corporate services providers, administrators of our funds, and providers of customer relationship management tools;
credit reference agencies and other third parties conducting background checks in the context of client, counterparty, or investment due diligence;
any third party as directed by you; and
other third parties in the context of a sale of our business or its assets or a restructuring exercise.

9. Is Your Personal Data Transferred Internationally?

We may transfer your personal data outside the DIFC or the UK (as applicable) from time to time, for the purposes outlined in this Privacy Notice. For example, personal data may be transferred to, or accessed by, third-party service providers located in the United States. This means that personal data may be transferred to jurisdictions that do not offer an equivalent level of legal protection as the DIFC or the UK.

When we transfer personal data internationally, we take appropriate steps to ensure that it remains protected in accordance with applicable data protection laws, for example:

the transfer is to a country that has been recognised by the DIFC Commissioner of Data Protection or the UK Government as providing an adequate level of protection;
we have put in place contractual terms approved by the DIFC Commissioner of Data Protection or the UK Government (as applicable) to ensure that your personal data is safeguarded appropriately; or
the recipient has certified to an approved certification mechanism, such as the US Data Privacy Framework scheme, in respect of which the UK has put in place the UK-US Data Bridge.

We may also rely on other lawful transfer mechanisms permitted under applicable data protection laws. In all cases, personal data will only be transferred where appropriate safeguards are in place.

If you would like further information about the safeguards we use in connection with international transfers, including copies of the relevant transfer mechanisms (where available), please contact us using the details set out at the end of this Privacy Notice.

10. How Long Do We Keep Hold of Your Personal Data?

We only retain personal data for as long as is reasonably necessary to fulfil the purposes identified above, as required by law, or to establish, exercise or defend potential legal claims. The period for which we retain personal data will depend on factors such as the nature of the information, the purposes for which it was collected and any applicable legal or regulatory retention requirements.

11. What Are Your Legal Rights?

You may have certain rights under applicable data protection law (subject to certain conditions), including:

to obtain access to your personal data and request information about how we process it;
to request the correction or completion of your personal data if it is inaccurate, incomplete or out of date;
to ask us to erase or destroy your personal data held by us in certain circumstances (please note that there may be circumstances where you ask us to erase your personal data, but we are legally entitled to retain it);
to object to, or ask us to restrict, our processing of your personal data in certain circumstances (please note that there may be circumstances where you object to, or request the restriction of, our processing of your personal data, but we are legally entitled to continue processing it);
to ask us to transmit personal data you have provided to us back to you or to another organisation in certain circumstances;
under the DIFC DPL: not to be discriminated against for exercising any of your rights under the DIFC DPL;
under UK GDPR: to lodge a complaint with us in relation to our processing of your personal data; and
where we are relying on your consent, to withdraw your consent at any time.

Please contact us using the contact details in Section 14 if you wish to exercise any of the above rights.

If you have a complaint about how your personal data is processed or whether your rights have been exercised correctly under this Privacy Notice, you have the right to complain to the relevant supervisory authority, the contact details for which can be found at Section 15.

12. Use of AI Tools - Your Rights Under the DIFC DPL

Please read this section carefully.

We use AI tools in some instances to process personal data subject to the DIFC DPL. When we do process your personal data using such tools, in some cases, due to the technical nature of how the particular tool operates, the personal data that is processed by the applicable tool is not strictly kept as a separate record that we can simply find, change or delete. Instead, it may be absorbed into the datasets used by the underlying AI model, and may also persist in copies such as back-ups or logs, including those held by the applicable third party providers we use. As a result, once your personal data has been processed in this way, it may not always be technically feasible for us to correct or erase it, or to give effect to an objection. This is an inherent limitation of certain AI systems.

Where it is technically feasible for us to access your personal data used in respect of such AI tools, your right to correct or erase it, or object to such processing should not be affected in the same way.

13. Your Responsibilities

It is important that the personal data we hold about you is accurate and up-to-date. If your personal data changes it is important for the protection of your own interests that you let us know promptly.

If you fail to provide certain information when requested, we may be unable to communicate with you, provide products or services, complete due diligence checks, or otherwise comply with our legal and regulatory obligations. This may result in us being unable to enter into or maintain a contractual or business relationship with you.

14. Contacts & Changes

If you have any questions about this Privacy Notice or the personal data we hold about you, please contact us:

by email at: [email protected].
by post to: JJJ Capital Management LLP, 5th Floor, Greycoat Stores, 10 Greycoat Place, London, SW1P 1SB, United Kingdom; or JJJ Capital Management (DIFC) Limited, Index Tower, Level 4, Unit 406, DIFC, Dubai.

We may update this Privacy Notice periodically. Where we make any material changes, we will inform you of those changes. This notice is non-contractual, which means it does not confer any legal rights and we may amend it at any time in line with law or good practice.

15. Complaints

We strive to process your personal data in accordance with applicable data protection law. If you have any concerns or complaints about how we process your personal data, please contact us at [email protected] or by using the details in section 14 above.

You also have the right to lodge a complaint with a supervisory body for data protection if you are not happy with how we handle your personal data. The DIFC Commissioner's Office is the supervisory body in the DIFC and may be contacted at Dubai International Financial Centre Authority, Level 14, The Gate Building, +971 4 362 2222, [email protected]. In the UK, the Information Commission is the supervisory body, and its contact details are available at www.ico.org.uk.