Privacy Policy

for Sector Asset Management group and associated companies (Sector)

Last updated: 14 January 2026

1. Introduction

The purpose of this Privacy Policy is to provide you with information on our processing of your personal data in accordance with the EU data protection regime introduced by the General Data Protection Regulation (Regulation 2016/679, the “GDPR”).
This Policy may be amended from time to time and the last updated version will be available on Sector’s website.

2. Who this affects

This Privacy Policy applies to all individual persons whose personal data we process, including investors, prospective investors, representatives of legal entities, suppliers, service providers, website visitors, and any other individuals who interact with companies of the Sector Asset Management Group and associated companies (“Sector”).

3. DATA CONTROLLER

The data controller responsible for your personal data is Sector
Kristian Augusts gate 15c, 0164 Oslo, Norway
Email: compliance@sector.no
Tel: +47 23 01 29 00

4. personal data we collect

Personal data includes information such as:

- name
- residential address
- email address
- other contact details
- corporate contact information
- signature
- nationality, place and date of birth
- personal identification (e.g., personal no., tax no., passport details)
- correspondence records (e.g., recorded phone calls, emails, meeting minutes)
- bank account details
- details relating to your investment activity in funds managed by any company within Sector

We only collect personal information that is reasonably necessary for us to provide you with our services, comply with obligations, and maintain our business operations. The information we collect will depend upon the nature of our relationship.

5. How AND WHY we may use your personal data

Sector, as the data controller, processes personal data only where a lawful basis under the GDPR applies. Sector may collect, store and use your personal data for the following lawful purposes:

5. 1. Compliance with legal obligations (Art. 6(1)(c) GDPR)

Including, but not limited to:
- fulfilling anti-money laundering (AML) and counter-terrorism financing (CTF) requirements
- verifying the identity of our customers/ beneficial owners (KYC)
- preventing fraud or financial crime
- responding to requests from regulatory authorities (supervisory, regulatory, tax, or law enforcement authorities)
- complying with accounting and record-keeping obligations

5. 2. Performance of a contract or steps prior to entering a contract (Art. 6(1)(b) GDPR)

Including, but not limited to:
- onboarding investors
- administering investments and accounts
- communicating with you regarding your agreements or requests
- managing business relationships and providing services
- fulfilling obligations in agreements with customers

5. 3. Legitimate interests (Art. 6(1)(f) GDPR)

Including, but not limited to:
- direct marketing purposes, in accordance with applicable law
- quality control, business and statistical analysis; for customer service, training and related purposes
- protecting legal claims and managing disputes
- maintaining IT security and operations
- internal administration

Personal data are only stored and processed when a legitimate interest exists and such legitimate interest is not overridden by your personal interests, fundamental rights or freedom. We will be acting in a fair, transparent and accountable manner and taking appropriate steps to prevent activities having any unwarranted impact on you, and noting your right to object to such storage.

Should we have a need to use your personal data for other specific purposes, we will contact you.

You have the right to object to processing based on legitimate interests. Please refer to point 11 “Your Data Protection Rights” below.

5. 4. Consent (Art. 6(1)(a) GDPR)

Where applicable, including, but not limited to:
- certain types of direct electronic marketing (if required by local law)
- optional cookies or analytics technologies
- any processing where consent is expressly requested

Where processing relies on consent, which must be freely given, specific, informed, and unambiguous, you have the right to withdraw it at any time. Please refer to point 11 “Your Data Protection Rights” below.

6. Cookies

To make our website work properly and improve your experience on our website, we may place small text files called cookies on your device. A cookie is saved by a website on your computer or mobile device when you visit the site. It enables the website to remember your actions and preferences (such as login, language, font size and other display preferences) over a period of time.

When you visit our website, we may collect information from you automatically through cookies or similar technologies.
- Strictly necessary cookies are used without consent
- Optional cookies (e.g., analytics) will only be used with your consent, where required

You can control cookies through your browser settings or via the cookie banner on our website. You can set your browser not to accept cookies. However, in a few cases, some of our website features may not function as a result.

7. When and why we may transfer your personal data

We may share your personal data with:
- Other Sector group entities, such as the investment manager, the back and middle office, the marketing and investor relations service providers, to fulfill delegates between each separate Sector company
- Fund administrators, depositaries, auditors, legal advisors, consultants
- IT and system providers, including providers of data hosting, cloud storage, cybersecurity, and communication systems
- Public authorities such as regulators, tax authorities, law enforcement, if there is a statutory duty of providing information/where required by law
- Banks, brokers, and financial intermediaries, as necessary to perform contractual obligations

All third-party recipients are subject to confidentiality obligations, and we require them to provide adequate data protection safeguards.

8. The data protection measures we take

Any transfer of personal data by us shall be subject to appropriate safeguards being in place in accordance with the GDPR requirements. We and our duly authorised delegates shall apply appropriate information security - technical and organisational - measures designed to protect your personal data in our possession against, including, but not limited to:
- loss
- misuse
- unauthorised access
- disclosure
- alteration
- any form of computer corruption

In accordance with GDPR requirements, we will notify you of any personal data breach affecting you that is likely to result in a high risk to your rights and freedoms.

For any additional information on the appropriate safeguards, please use the contact details included under point 13 "Getting in touch" below.

9. AUTOMATED DECISION-MAKING AND PROFILING

Sector does not make decisions based solely on automated processing - including profiling - that produce legal or similarly significant effects for individuals. If this changes, we will notify you and provide all required GDPR safeguards.

10. CHILDREN’S DATA

Our services are not directed at children, and we do not knowingly collect or process personal data of individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us so that we may delete it.

11. YOUR DATA PROTECTION RIGHTS (CHAPTER 3 GDPR)

You have certain rights regarding our use of your personal data such as:

Under the GDPR, as a data subject, you have the following rights:
- the right to be informed about the collection and processing of your personal data
- the right to access your personal data and obtain a copy of the personal data we hold about you
- the right to rectification of inaccurate or incomplete personal data
- the right to erasure, i.e., for your data to be erased ("right to be forgotten"), where applicable
- the right to restrict processing of your personal data, under certain conditions
- the right to data portability (to request the transfer of the data we have collected to another organisation/directly to you, under certain conditions
- the right to object to the processing of your data where processing is based on legitimate interests
- the right not to be subject to automated decision-making, including profiling
- the right to withdraw any consent given to the processing of your personal data (when processing is based on consent)
- the right to lodge a complaint with the Norwegian Data Protection Authority (“Datatilsynet”)

If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please use the contact details included under point 13 “Getting in touch” below.

12. Our retention of your personal data

We and our authorised delegates retain personal data only for as long as necessary for the purposes for which it was collected and in accordance with applicable legal, regulatory, and operational requirements.

Generally, personal data is retained for up to seven years after the end of the business relationship, unless longer retention is required (e.g., for AML rules, tax regulations, or ongoing legal matters). Thereafter, the personal data will be securely deleted or anonymised.

13. Getting in touch

Should you have any queries or wish to discuss your data protection rights with us, please contact our Compliance team at compliance@sector.no or +47 23 01 29 00.