On the keeping of records.

Effective 26 October 2026. This policy explains how VFS Trust and Savings Co Kommanditbolag, doing business as Virgin Financial Service (“the firm,” “we,” “us”), processes personal data in accordance with the EU General Data Protection Regulation (GDPR) and Swedish data protection law, when you visit this site, enquire about a program, use the client portal, or correspond with us.

The controller

The controller of your personal data is VFS Trust and Savings Co Kommanditbolag, a limited partnership registered in Sweden (reg. no. 969805-1092). We have not appointed a data protection officer; privacy questions and requests go to the contact details at the end of this policy.

What we collect and why

For each purpose below we set out the data involved and our legal basis under Article 6 of the GDPR.

• Prospectus requests and enquiries. Your name, email address, telephone number (optional), the interest you describe, the program concerned, and your attestation of qualified-investor status. We use these to respond, to decide whether a program may lawfully be offered to you, and to send a prospectus. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b)) and our legitimate interest in offering programs only to eligible investors (Art. 6(1)(f)).
• Client onboarding and the client portal. Registration and account details you provide in the portal, and records of your relationship with us. Legal basis: performance of a contract (Art. 6(1)(b)) and compliance with legal obligations (Art. 6(1)(c)).
• Identity verification (KYC). Identity document images and data, a selfie or short video used to confirm that you are present and match your document, and the verification outcome. Legal basis: compliance with legal obligations, including anti-money-laundering requirements where they apply to us (Art. 6(1)(c)), and otherwise our legitimate interest in knowing our clients (Art. 6(1)(f)). Where facial images are processed as biometric data to verify your identity, we rely on your explicit consent, which you give when you start the verification (Art. 9(2)(a)).
• Correspondence. The content of emails and letters you send us and our replies. Legal basis: our legitimate interest in responding and keeping a record (Art. 6(1)(f)).
• Site security and operation. IP address, browser and device characteristics, and request data, processed to deliver the site, to protect it and the prospectus form from bots and abuse, and to investigate incidents. Legal basis: our legitimate interest in a secure, working site (Art. 6(1)(f)).
• Audience measurement. Aggregated, cookieless page-view statistics (pages visited, referrer, approximate country, browser type) to understand how the site is used. Legal basis: our legitimate interest (Art. 6(1)(f)).

Name, email address, and the attestation are required to process a prospectus request; without them we cannot respond. Identity verification is required before an account can be opened. Everything else is optional.

Where your data comes from

Mostly from you. We also receive verification results from our identity verification provider and, where you were introduced to us, your contact details from the person who introduced you.

Cookies

We do not use advertising or tracking cookies, and our audience measurement does not use cookies. Our hosting and security provider may set strictly necessary security cookies — __cf_bm (bot detection; expires after 30 minutes of inactivity) and cf_clearance (records that a security check was passed). These are needed to protect the site and do not require consent.

Who processes your data

We use the following service providers. They process personal data on our behalf under data processing agreements and only on our instructions.

• Cloudflare, Inc. (United States) — site hosting, content delivery, the server that receives prospectus requests, bot protection (including Turnstile), and cookieless web analytics.
• HubSpot (HubSpot Ireland Limited; HubSpot, Inc., United States) — customer relationship management for enquiries.
• Google (Google Cloud EMEA Limited, Ireland; Google LLC, United States) — email and correspondence, including system emails sent from the client portal.
• EBANQ Fintech SL (Spain) — the client portal, hosted in the European Union.
• Sum and Substance Ltd (Sumsub, United Kingdom) — identity verification.

We may also disclose personal data to professional advisers, auditors, and banks as needed to operate the programs, and to public authorities where the law requires it. We do not sell personal data.

International transfers

Some providers process data outside the European Economic Area. Transfers to the United Kingdom rely on the European Commission’s adequacy decision. Transfers to the United States are made to providers certified under the EU–U.S. Data Privacy Framework or, where that does not apply, under the European Commission’s Standard Contractual Clauses with supplementary measures. You may ask us for information about the safeguards for a particular transfer.

How long we keep it

• Enquiries that do not lead to a client relationship: up to 24 months after our last contact.
• Client records and identity verification data: for as long as the relationship lasts and afterwards for as long as anti-money-laundering law requires (generally five years after the relationship ends).
• Accounting records: seven years, as required by Swedish bookkeeping law.
• Security and server logs: a short period, normally no longer than 30 days.

Your rights

Under the GDPR you have the right to access your personal data, to have it corrected, to have it erased, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interests. Where we rely on your consent, you may withdraw it at any time without affecting earlier processing. Some rights are limited where we must keep data by law. We respond within one month.

Identity verification includes automated checks, but decisions on whether to accept a client are reviewed by a person; we do not make decisions about you based solely on automated processing.

Complaints

Please contact us first so we can try to resolve your concern. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), or with the supervisory authority where you live or work.

Integritetsskyddsmyndigheten
Box 8114
104 20 Stockholm
Sweden
imy@imy.se · +46 8 657 61 00 · imy.se

Security

We use encryption in transit, access controls, and reputable providers to protect personal data. No system is perfectly secure; if a breach occurs that is likely to put you at high risk, we will tell you.

Children

The site and programs are not intended for anyone under 18, and we do not knowingly collect their data.

Changes to this policy

We may update this policy. The current version is always on this page with its effective date; we will tell clients about material changes.

Contact

Privacy questions and requests to exercise your rights may be sent to:

VFS Trust and Savings Co Kommanditbolag
Stockholm Brevboxar 648
116 74 Stockholm
Sweden
Clientservices@virginfinancialservice.com