Privacy policy

Who we are and who this policy covers

This policy applies to personal information collected by Red Oak Compliance Software, LLC and its affiliates, including MirrorWeb Limited and MirrorWeb Inc. (together "Red Oak", "we", "us" and "our"). Where this policy says "we", it means the Red Oak company that collects the information or decides how it is used. Contact us lists the registered details of those companies.

This policy applies to all websites we operate, as indicated on the relevant website (our "Sites"), and to the information we receive in the course of our business with:

• visitors to our Sites and people who contact us or subscribe to our email;
• clients and prospective clients, and their members, distributors, sales representatives, business affiliates and other representatives;
• investors and prospective investors in any fund or account managed or advised by us; and
• business contacts working with our service providers.

Red Oak adopted this policy in recognition that protecting the privacy and security of the nonpublic personal information we obtain about our clients is an important responsibility. We want you to know what information we collect and how we use and safeguard it.

Information we collect

We collect personal information directly from you, from the people who act for you, from our clients and your employer, from third parties, and automatically when you use our Sites. The categories we may collect, depending on our relationship with you, include:

• Contact information: your full name, business or home mailing address, telephone number, business or personal email address, and job title or role.
• Identification information: date of birth, social security number, driver's license or passport number, tax or other identification numbers and documents, and other similar identifiers.
• Financial information: documents and information about your income, your brokerage accounts and transactions (such as purchases, sales, account balances and inquiries), and your holdings with us.
• Account and profile information: your name and email address, and for a profile on our Sites your address, telephone number, profile pictures, gender, date of birth, interests, educational details and employment details.
• Service information: personal information that you or your employer provide in the course of using our services.
• Commercial information: records of products or services purchased, obtained or considered, and purchasing histories or tendencies, including transaction details and payment card details.
• Enquiry, notification and correspondence information: what you submit in an enquiry, what you provide when you subscribe to email or newsletters, and the content and metadata of communications you send us, including through our website contact forms.
• Usage and browsing information: IP address and internet service provider, geographical location and geolocation data, browser type and version, language, domain name, operating system, referral source, length of visit, pages viewed, navigation paths, the timing, frequency and pattern of your use, and your interaction with our Sites, applications and advertisements.
• Professional or employment-related information: job application or resume information, and past and current job history.
• Information you post: anything you post for publication on our Sites or through our services.
• Inferences: profiles reflecting preferences, characteristics and behavior, drawn from the information above.
• Security footage: images recorded for safety and security purposes when you visit our premises.

We obtain this information:

• directly from you, through applications, subscriptions, forms and other material you complete or supply, and through your communications with us or your authorized representatives (such as your attorney or accountant) by electronic, telephone, written or in-person means;
• from an actual or prospective client or a third party who supplies it to us, and from your employer;
• from data aggregators, social media and companies with which we have business relationships;
• from other written, electronic or verbal correspondence about the business activities of an actual or prospective client; and
• automatically, using cookies, email tracking and similar technologies, including analytics services such as Google Analytics.

Please do not supply another person's personal information to us unless we ask you to.

How we use information

We use personal information to meet our contractual and statutory obligations, for our legitimate interests, with your consent where the law requires it, and for other purposes for which we have a lawful basis. Where UK and EU data protection law applies, the table sets out what we use each kind of information for and the legal basis.

We also use personal information:

• to administer and deliver the products and services you have requested, and to respond to your requests, such as access requests and scheduling meetings;
• to report to, or communicate with, actual or prospective clients or third parties consistent with our obligations to our clients;
• to present our Sites and their contents to you, to operate them efficiently, and to improve our services and personalize your experience;
• to retain records of our business transactions and communications;
• to comply with legal and regulatory requirements, such as regulations aimed at preventing money laundering or terrorist financing and other "know your client" requirements;
• to verify the status or eligibility of an actual or prospective client for our services and to meet tax reporting requirements;
• for due diligence and monitoring of counter-parties;
• in connection with litigation, investigations, and regulatory or governmental inquiries involving Red Oak or our clients;
• to carry out our obligations and enforce our rights;
• in any other way we describe when you provide the information, at your direction or with your consent, as permitted by law or as we notify you; and
• for other legitimate business interests.

Our use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Marketing and email

When you subscribe to a mailing list we collect your name, email address and other contact details. We and our service providers may use them to contact you by email, fax, telephone or post with information or promotional material about our products and services, news updates, research or market commentary, conferences and events.

You can opt out of marketing communications at any time in your email preferences or through the link in the footer of each email we send. In some circumstances we need your consent before sending marketing communications.

To understand what interests our readers and to follow up on responses, we track responses to our email using small image files placed in the body of our messages. They tell us whether a message was opened and which links were clicked.

Cookies and similar technologies

A cookie is a file containing an identifier, such as a string of letters and numbers, that a web server sends to a web browser and that the browser stores. The browser sends the identifier back to the server each time it requests a page. A cookie can be persistent, which means it stays until its expiry date unless you delete it earlier, or a session cookie, which expires when you close your browser. Cookies do not typically contain information that identifies you directly, but personal information we hold about you may be linked to information stored in and obtained from cookies.

We use cookies and similar technologies on our Sites to provide a better experience and to improve our Sites. Where the law requires consent for cookies that are not strictly necessary, we ask for it when you first visit our Sites, and you agree to the use of cookies described in this policy when you give it. We use cookies for these purposes:

• Strictly necessary. These make our Sites usable by enabling basic functions, and our Sites cannot work properly without them. They are always active.
• Preferences. These remember information that changes how our Sites behave or look, such as your preferred language or location, and store your cookie choices.
• Statistics and analysis. These help us understand how visitors move around and use our Sites, by collecting and reporting information anonymously, so that we can improve their design and performance.
• Marketing. These track your visit across our Sites so that we and our advertising providers can show you, and others like you, advertising and content that may interest you, and can record the pages you visit and the links you follow.

Some of our service providers, including Google Analytics and Google Ads, set cookies when you visit our Sites. They collect information about how our Sites are used and use it to create reports for us. Google's privacy policy is available at policies.google.com/privacy. In some cases we use information from third party cookies for market research or to improve the design of our Sites, for example to learn where traffic to our Sites comes from.

You can review and change what cookies we use through the cookie settings on our Sites. Most browsers also allow you to refuse or delete cookies, and the method varies by browser and version. Up-to-date information is available for Chrome, Firefox, Safari, Edge and Opera. Blocking all cookies affects the usability of many websites, and you may not be able to use all the features of ours.

Who we share information with

Red Oak does not disclose the nonpublic personal information it collects about clients to anyone except:

• in furtherance of our business relationship with clients, and then only to those persons necessary to carry out the transactions and provide the services that clients authorize, such as broker-dealers, custodians and independent managers;
• to persons assessing our compliance with industry standards, such as professional licensing authorities;
• our attorneys, accountants and auditors; or
• as otherwise provided by law.

We are permitted by law to disclose nonpublic personal information to governmental agencies and other third parties in certain circumstances, such as third parties that perform administrative services on our behalf. Those third parties are prohibited from using or sharing the information for any other purpose. If you terminate our services or become an inactive client, we will continue to follow this policy, as it may be amended from time to time.

For other personal information, we may share it with:

• Red Oak companies. Members of our group of companies, meaning our subsidiaries, our ultimate holding company and all its subsidiaries, and the funds we manage, for the purposes in this policy.
• Service providers and suppliers. Third parties contracted to us in the course of dealing with you, such as attorneys, auditors, accountants, tax advisers, administrators, custodians, depositaries, distribution managers, brokerage firms, event organizers, marketing and advertising services, analytics services, email services and other agents, advisers or vendors. They are obliged to keep your details secure, to use them only to provide the service they perform for us, and to dispose of them in line with our procedures when they no longer need them.
• Payment providers. Payment services providers, to process payments, refunds, complaints and queries, and only to the extent necessary for those purposes.
• Counter-parties. Managers, general partners, investment advisers, administrators and their agents or representatives, where the purposes in this policy require it.
• Selected suppliers. Where you submit an enquiry, selected third party suppliers of goods and services identified on our Sites may receive it so they can contact you. Each acts as a controller of that information and will give you a copy of its own privacy policy, which governs its use.
• Insurers and advisers. Insurers and professional advisers, as needed to obtain or maintain insurance cover, manage risks, obtain professional advice, or establish, exercise or defend legal claims.
• Authorities and courts. Regulatory authorities (including tax authorities), courts and other bodies, as required by law, as requested for internal investigations and reporting, in connection with litigation or regulatory inquiries involving Red Oak or our clients, or where disclosure is necessary to comply with a legal obligation or protect vital interests.
• Buyers and successors. Third parties, as part of or in connection with a sale, merger, combination, consolidation, change of control, transfer of assets or reorganization of all or part of our business. We may transfer, sell or assign the information described in this policy to them.

We do not currently sell your personal information for money. The California Consumer Privacy Act defines a "sale" very broadly. In the past twelve months we have disclosed the following categories to service providers such as website advertising and analytics services, and those disclosures may be considered a sale or sharing under that law: identifiers, categories of personal information described in California Civil Code section 1798.80(e), internet or other electronic network activity information, geolocation data, and inferences drawn from personal information. We have shared the categories of information listed in Information we collect for a business purpose with our affiliates, with entities that provide marketing services to us, and with our service providers and vendors.

Transfers outside the UK and EEA

Where third parties process your personal information outside the UK and the European Economic Area (EEA), we make sure appropriate safeguards are in place, as applicable law requires. The internet is accessible globally, so collecting and transmitting personal information is not always limited to one country. We may transfer your information, for the purposes in this policy, to Red Oak companies, service providers and other third parties in countries outside the EEA whose laws may not give the same level of protection as the EEA. This includes transfers to Red Oak companies in the United States, which may collect some information directly from you through the Sites they operate, and to third parties who provide us with email and marketing services.

Where we transfer information, we protect it with appropriate safeguards such as the standard data protection clauses adopted or approved by the European Commission or the UK, where they apply. You can ask us for a copy of the safeguards using the details in Contact us.

Information that you submit for publication through our Sites or services may be available through the internet around the world. We cannot prevent others from using or misusing it.

How long we keep information

We keep personal information for no longer than is necessary for the purposes for which we process it, and we work to keep it accurate and up to date. The law requires us to keep some information, such as information needed for income tax and audit purposes. How long other information is kept may be governed by sector requirements and agreed practices. Where we cannot set a period in advance, we decide how long to keep information by how relevant it is to you, your company or your role, and to the purposes we hold it for. We may keep information for longer where retention is necessary to comply with a legal obligation, to protect your vital interests or those of another person, or for legal claims, or where individual business needs require it.

How we protect information

We restrict access to nonpublic personal information to the employees who need to know it to serve you. We are committed to keeping the information you give us secure and take reasonable precautions to protect it from loss, misuse or alteration. We maintain physical, electronic and procedural safeguards that comply with applicable federal and state standards, and we have information security policies, rules and technical measures to protect the personal information under our control from:

• unauthorized access;
• improper use or disclosure;
• unauthorized modification; and
• unlawful destruction or accidental loss.

Your choices

• Marketing email. Opt out in your email preferences or with the link in any email we send.
• Cookies. Use the cookie settings on our Sites or your browser settings, as described in Cookies and similar technologies.
• Sharing nonpublic personal information. Clients can opt out of our sharing their nonpublic personal information with non-affiliated third parties when the information is not necessary to serve their accounts. To opt out, write to us or call us using the details in Contact us. Say your name, your account number and the specific information you wish to restrict from sharing. We process your request within a reasonable time, not to exceed thirty (30) days.
• Sale or sharing under California law. California residents can opt out of the sale or sharing of their personal information, as described in Your rights.
• Consent. Where we rely on your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before you withdraw.

Your rights

Your rights depend on where you live and on the law that applies to the information. We summarize them here, and the summaries do not include every detail. Read the relevant law and the guidance of your regulator for a full explanation.

If you are in the UK or the European Union

You have the right to:

• Access. Confirmation of whether we process your personal information and, if we do, a copy of it and details of the purposes, the categories of information, the recipients, how long we keep it, the source if we did not collect it from you, any automated decision making and profiling and the logic involved, whether providing the information is a legal or contractual requirement and the consequences of not providing it, and how we protect any transfer to a third country or international organization. Provided the rights and freedoms of others are not affected, we supply a copy of your personal information. The first copy is free of charge, and we may charge a reasonable fee for additional copies. We may ask for proof of your identity.
• Rectification. Have inaccurate information corrected and, taking the purposes into account, incomplete information completed.
• Erasure. Have your information erased without undue delay in some circumstances, such as when it is no longer necessary for the purposes we collected it for, you withdraw consent to consent-based processing, you object to the processing under certain rules of applicable data protection law, the processing is for direct marketing, or the information has been processed unlawfully. The right does not apply where processing is necessary to exercise the right of freedom of expression and information, to comply with a legal obligation, or to establish, exercise or defend legal claims.
• Restriction. Restrict processing in some circumstances: you contest the accuracy of the information, processing is unlawful but you oppose erasure, we no longer need the information but you need it for legal claims, or you have objected to processing and the objection is pending verification. Where processing is restricted, we may continue to store the information, and we otherwise process it only with your consent, for legal claims, to protect the rights of another person, or for reasons of important public interest.
• Objection. Object, on grounds relating to your particular situation, to processing that is necessary for a task carried out in the public interest or in the exercise of official authority vested in us, or for the legitimate interests pursued by us or a third party. If you object, we stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is for legal claims. You can also object at any time to processing for direct marketing, including profiling for it, and we stop processing for that purpose when you object. You can object to processing for scientific or historical research or statistical purposes, unless the processing is necessary for a task carried out in the public interest.
• Portability. Receive information you provided to us in a structured, commonly used and machine-readable format, where the legal basis is consent or contract and the processing is automated, unless this would adversely affect the rights and freedoms of others.
• Withdraw consent. At any time, where the legal basis is consent.
• Complain. Lodge a complaint with the supervisory authority responsible for data protection, in the member state of your habitual residence, your place of work or the place of the alleged infringement.

If you are a California resident

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (together the "CCPA"), gives you the right to:

• know, for the twelve months before your request, the categories and specific pieces of personal information we collected about you, the categories of sources, the business or commercial purpose for collecting or selling it, the categories of personal information we shared for a business purpose or sold, and the categories of third parties that received it;
• request that we delete your personal information;
• correct inaccurate personal information we hold about you;
• opt out of the sale or sharing of your personal information, and limit our use of sensitive personal information; and
• not be discriminated against for exercising these rights.

The CCPA does not cover all of the personal information we collect. For example, information collected, processed or sold under the federal Gramm-Leach-Bliley Act is covered by the sections of this policy on nonpublic personal information, and information collected about you in a business-to-business context, including when you communicate with us as an employee of a business to which we provide a product or service or from which we receive one, is outside the CCPA.

We may decline a request to delete personal information in whole or in part where an exception applies, such as to complete a transaction, provide a service you requested, or perform our contract with you; detect security incidents or protect against fraudulent or illegal activity; debug products to repair errors; exercise free speech or another right provided by law; comply with the California Electronic Communications Privacy Act; carry out public or peer-reviewed research in the public interest in the circumstances the law describes; enable internal uses that are reasonably aligned with your expectations based on your relationship with us; comply with a legal obligation; or make other internal and lawful uses of the information that are compatible with the context in which you provided it.

If you are a client or an investor in the United States

The sections of this policy on information we collect, who we share information with, how we protect information and your choices include the notice that federal law requires about nonpublic personal information, such as your name, address, social security number and account and transaction information. We will give you notice of any material change to how we obtain and disclose that information before we make the change.

How to make a request

To exercise a right, or to ask for a copy of this policy, contact us using the details in Contact us. You can also write to us. We answer only requests we can verify. To verify a request we may need you, or the authorized agent acting for you, to authenticate, in a way that is reasonable for the information requested, and we may ask for more information to match what we already hold. We use new information you give us solely to verify your request. We reply to ask for more information promptly, so please reply promptly, and we will tell you if we cannot verify your request.

Changes to this policy

We update this policy from time to time to reflect new legislation or industry practice, changes at Red Oak and customer feedback. We publish the new version on this page. We will give you notice of any material change before we make it, and we may notify you of changes by email. Please check this page from time to time.

Contact us

For a request or question about this policy, your information or your rights, or to ask for a copy of this policy:

• Online: use the contact form.
• By telephone: (888) 302-4594.
• By post, North America: Red Oak, 111 Congress, Suite 1300, Austin, Texas 78701.
• By post, United Kingdom: Red Oak, Manchester House, 18-22 Bridge Street, Manchester, M3 3BZ.
• Data protection officer (UK and EU matters): dpo@mirrorweb.com.

The companies named in this policy are:

• Red Oak Compliance Software, LLC.
• MirrorWeb Limited, registered in England and Wales under registration number 08072284, with its registered office and principal place of business at Manchester House, 18-22 Bridge Street, Manchester, M3 3BZ.
• MirrorWeb Inc.