Investcorp Privacy Notice – Kingdom of Saudi Arabia

February 2025

Investcorp is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Notice describes how each Investcorp group entity, whether incorporated in the Kingdom of Saudi Arabia or elsewhere, that collects, uses or discloses personal data in the Kingdom of Saudi Arabia from time to time (collectively “Investcorp”, “we”, “us”, and “our”),
respectively may collect, process, use, disclose and shall protect your personal data, subject to applicable law in the jurisdiction in which the relevant entity is incorporated. This Privacy Notice also demonstrates our commitment to privacy and outlines your rights regarding your personal data.

1. INFORMATION WE MAY COLLECT ABOUT YOU, HOW WE COLLECT IT AND HOW WE USE IT

We intend to give you as much control as reasonably possible over your personal data (information that can be used to identify you, such as your name, email address, telephone numbers, postal address, credit card information, etc.) that we hold about you.

Set out below is a list of the types of personal data we may collect about you. Collection of certain information in the below list is optional.

  • Contact details: Name, title, postal address, email address, phone number.
  • Personal / demographic information: Age, date of birth, sex, gender, citizenship, marital status and your image (i.e., in photographic and/or videographic form).
  • Government identifiers: Passport number and/or copy, national identification number and/or document, national insurance or social security number and/or document, driving licence and/or other government identification information and/or documents.
  • Educational information: Education details and academic records (including schooling, grades and/or degrees obtained).
  • Professional information: Current and/or historic employer and/or employment information (or information about the entity or person you represent) and associated contact details (including job title, employer or associated entity, postal address, email address and phone number), professional licences and/or memberships.
  • Financial and tax information: Bank details, wire transfer instructions, source of funds/wealth, account balances, transaction history, investing preferences, investment history, risk tolerance, tax domicile and tax status (and related identifications and/or certifications).
  • Information about other interests: Directorship / equivalent information, information in relation to other commercial interests (including shareholding or other interests).
  • Business development information: Details of any interactions you have had with directors, officers, employees and/or other representatives of the Investcorp group, including the time and date of the relevant interaction, with whom at Investcorp the interaction took place, how / in what form the interaction took place and the location of such meeting (e.g., phone call, physical or virtual meeting or email), the primary purpose of the interaction and a summary of the interaction.
  • Online identifying information: Information on your location, your usage of our website (e.g., user movement including page scrolling, clicks, text entered, etc.) and information on your device.

We may collect personal data about you:

  • Directly from you or as a result of interactions we or our affiliates have with you.
  • On your behalf by a representative of yours.
  • From third parties (including from publicly and freely available databases, from
    databases provided by third parties for a fee and/or from other third parties such as
    banks and/or governmental and/or regulatory authorities).
  • From analysis of online usage information about you.

Set out below is a list of the purposes for which we may use personal data about you, depending upon the nature of our relationship with you:

  • Client onboarding, account opening, and maintenance: If you are to become, or are already, a client of ours, we collect information for the purposes of know your client (“KYC”) compliance checks prior to opening your account or effecting your investments to enable us to identify and verify your identity in accordance with anti-money laundering regulations. We also conduct KYC checks from time to time to ensure the information we hold on you is up-to-date.
  • Providing services to you (including any subscription or redemption): If you are a client of ours, we collect information to enable us to market and deliver existing and new services to you, process your transactions, provide you with investor reports about your portfolio of investments, issue you with share certificates, etc. In such instances, failure to provide your personal data may mean that we are not able to communicate with you or have a business relationship with you.
  • Marketing purposes: Regardless of whether you are to become, are, or have ever been, a client of ours, with your express consent, we may contact you with marketing and offers relating to products and services we offer. Where we process your personal information for direct marketing purposes, please be aware that you may halt the reception of marketing material whenever desired. If you do so, we will log your objection, stop processing your data for direct marketing purposes, and we will not contact you again.
  • Personalize our products and services: Regardless of whether you are to become, are, or have ever been, a client of ours, we collect online identifying information through the use of cookies (please refer to our cookie policy) and analytics tools to allow us to (i) show the version of our website that is most relevant to your location, (ii) tailor our website in accordance with your preferences, and (iii) help us identify website usability issues. Offline, we may retain information about the investments and products you are most interested in so that we know what opportunities to inform you of in future.
  • Special events: Regardless of whether you are to become, are, or have ever been, a client of ours, we may collect information from you when we organize special events to which you subscribe, to enable us to better service your needs during your attendance at such events. We may take photographs at our events and it is possible that such photographs will include your image. We take such photographs for use in promotional materials for future events and we may upload these photographs to our website or microsites that we create for such events and/or as part of press releases or social media posts. Please be aware that you may object to our processing of your personal data in this way at any time. If you do so, we will log your objection, stop processing your data for this purpose, and we will not contact you again.
  • Compliance with legal or regulatory obligations: Regardless of whether you are to become, are, or have ever been, a client of ours, we collect information in relation to compliance with our legal and regulatory reporting obligations. This may include executed share purchase agreements, transaction histories, certifications related to FATCA/CRS or other tax reporting requirements, etc.
  • Business development purposes: Regardless of whether you are to become, are, or have ever been, a client of ours, we may contact you with prospective investment, co-investment, strategic partnership or other proposals for you and/or the organization you are employed by or that you represent. Where we process your personal information for this purpose, please be aware that you may object to our processing of your personal data in this way at any time. If you do so, we will log your objection, stop processing your data for this purpose, and we will not contact you again.
  • Visitors to our offices: If you visit our offices we will collect information about you to enable us to verify your identity and record the fact of your visit for security and health and safety purposes (which, for the avoidance of doubt, may include capturing your image on closed-circuit television (“CCTV”)).
  • Security: Investcorp will also process your personal data for the purpose of ensuring office security and for health and safety purposes. Please note that CCTV operates in some of our buildings; where CCTV is not operated by us, the relevant landlord, property manager and/or operator will control the CCTV and will be the controller of any
    personal data collected via such CCTV.

We do not perform any regular automated-decision-making activities, including profiling activities, where your personal data is processed by automated means, except as described above in relation to the use of cookies in our cookie policy.

We will only collect, use, disclose or process your personal data if and to the extent applicable law provides a lawful basis for us to do so and in particular:

  • if you have consented to us doing so;
  • if we need it to perform the contract we have previously entered into with you;
  • if we need it to comply with applicable laws;
  • if processing is required for security purposes or to satisfy judicial requirements; or
  • if we have a legitimate interest which is not overridden by your interests or fundamental rights and freedoms. Such legitimate interests may include, but shall not necessarily be limited to, certain of the purposes listed above. For the avoidance of doubt, in no case we can provide sensitive data on the basis of legitimate interest.

2. SHARING YOUR PERSONAL DATA

We may share your personal data as follows:

  • Within Investcorp: We may share your personal data with other entities in the Investcorp group for the purposes of processing it in accordance with this Privacy Notice.
  • With third-party service providers: We may share your personal data with our service providers for the purposes of processing it in accordance with this Privacy Notice. This may include the provision of your personal data to IT service providers, fund and other administrators, marketing advisors, legal and other professional advisors and other service providers we may deal with from time to time. We may also provide your personal data to any successor, or potential successor, to all or part of our business (or otherwise as necessary in connection with an investment into or transaction related to our business).
  • With governmental, regulatory and/or supervisory bodies: We are regulated in various jurisdictions and have reporting obligations and other regulatory requirements that may require us to disclose your personal data to governmental, regulatory and/or supervisory bodies.
  • With other counterparties: In order to carry out our business activities, we are often required by our counterparties who perform their own KYC procedures to provide certain information to them relating to Investcorp’s beneficial owners or the beneficial owners of the investments arranged by Investcorp.

When we share your personal data outside of the Investcorp group, we will ensure they agree to apply equivalent levels of protection for personal data as we do. If this is not possible, for example because we are required by law to disclose information, we will ensure that sharing of that information is lawful.

We will not otherwise use, share, disseminate, publish or disclose your personal data (except as may be required in response to litigation, investigations or other legally required disclosures).

3. INTERNATIONAL DATA TRANSFER

We may transfer your personal data to, or store it in, a jurisdiction outside the Kingdom where we originally collected your personal data or where you are located (the “Data Origin Jurisdiction”). This is because Investcorp is a global business, with operations located in various jurisdictions, which uses service providers based in a number of locations worldwide.

To the extent allowed by applicable laws, such transfers will achieve the following purposes: to perform obligations that we have under the contract signed with you, and to perform necessary operations for central processing within the Investcorp group.

If your personal data is transferred outside of the Data Origin Jurisdiction, we will put in place appropriate safeguards with the relevant recipient of the personal data in accordance with applicable legal requirements, to ensure that the recipient is bound by legally enforceable obligations or specified certifications to protect your personal data to a standard comparable with the applicable data protection laws of the Data Origin Jurisdiction. Where required or recommended under applicable laws, appropriate safeguards will include entering into Standard Contractual Clauses with the data recipients.

With respect to transfers of personal data within the Investcorp group, Investcorp has in place a “Global Data Transfer Agreement” which includes appropriate safeguards for and governs the processing (including transfer) of your personal data within the Investcorp group.

4. PERSONAL DATA STORAGE DURATION

We will store your personal data for only such period as is necessary to fulfil the purposes described above. Once the purpose has been fulfilled, and the storage of your personal data is no longer required for legal purposes, we will securely delete it.

When determining the appropriate retention period for a particular item of personal data, we will take into consideration criteria including, without limitation:

  • the type of personal data;
  • the sensitivity of the relevant type of personal data;
  • the volume of each type of personal data;
  • the potential risk of harm from unauthorised use or disclosure of the relevant type of personal data;
  • the purpose for which the relevant personal data was collected and whether that same purpose could be achieved through other means; and
  • applicable legal, regulatory, tax, accounting or other requirements or considerations.

By way of illustration, with respect to KYC information and transaction data, applicable law in the jurisdictions in which we operate varies with respect to the corresponding minimum required retention periods, but the minimum required retention period across the jurisdictions in which we operate is, with respect to (i) KYC information, 7 years after our relationship with the relevant data subject ends, and (ii) transaction data, 7 years after the date of the relevant transaction. However, depending upon the relevant jurisdiction, either or both of these periods may be longer and, in some cases, significantly longer.

In all cases, it is possible that we may retain some or all of your personal data for a longer period than originally determined if the purpose for which the personal data was collected is still valid and retention is necessary for legal purposes; for example, in the event of a complaint by you or with respect to our relationship with you, if we reasonably believe there is a prospect of litigation with respect to our relationship with you and/or if we are requested or required to do so by a governmental, regulatory and/or supervisory body.

The above notwithstanding, we regularly assess our need to retain personal data by reference to the purposes for which it was collected. Where it is no longer necessary to retain the data (and retention is no longer necessary for legal purposes, such as where legal obligations do not mandate further retention) we will securely delete or otherwise destroy your personal data.

5. OUR WEBSITE AND ELECTRONIC NEWSLETTERS

  • Links to third-party websites: Our website may contain links to other websites of interest. However, once you have used these links to leave our website, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such websites and such websites are not governed by this Privacy Notice. You should exercise caution and look at the privacy notice applicable to the website in question.
  • Message boards/forums: Our website may make forums and message boards available to you. Please remember that any information that is disclosed in these areas becomes public information. You should exercise caution when deciding to disclose your personal data.
  • Electronic newsletters: We may from time to time offer various free electronic newsletters. We do not spam, sell or rent email addresses and we will only send you our newsletter where we are complying with applicable laws regulating direct marketing. You may remove your address from our mailing lists by sending us an email.

6. YOUR RIGHTS

We rely on you to provide accurate, complete and current personal data to us.

  • Access. You may contact us at any time in order to request access to the personal data we hold about you. Subject to applicable law, we will confirm whether we are processing your personal data, provide details of the categories of personal data concerned and the reasons for our processing. Subject to applicable law we can also provide you with a copy of your personal information (in a reasonable and clear format either electronically or in a printed hard copy, if feasible) on request. Subject to applicable law, as a general rule, we will respond to your request within a period not exceeding thirty (30) days and without delay. We reserve the right to take appropriate measures to verify the identity of the requester before executing the request in accordance with applicable legal requirements. We can refuse to act on your request when we consider it repetitive, manifestly unfounded, or when it requires disproportionate efforts, and we will notify you on this decision respectively.
  • Rectification. If the information we hold appears to be inaccurate or incomplete we will take every reasonable step to not use it, and not allow others to use it, until it is corrected. Subject to applicable laws, you can ask us to correct or complete your personal data by contacting us at any time. To the extent possible or permitted under applicable laws, we will inform anyone who has received your personal data of any corrections we make to it. We reserve the right to request needed supporting documents or evidence to verify in order to update, correct, or complete your data, provided that such documents or evidence are destroyed once the verification process is completed.
  • Withdrawal of Consent. You may withdraw your consent for the collection, use, and disclosure of your personal data at any time by contacting us in writing. Upon withdrawal of consent, we will cease processing your personal data unless there is another legal basis for processing. Your consent does not form a condition of providing a service or a benefit from us, but please note that if you withdraw your consent, we may not be in the position to continue to provide our services to you. To the extent possible or permitted under applicable laws, we will inform anyone who has received your personal data of withdrawal of your consent.
  • Restriction. In certain circumstances, it may be possible to require us to limit the way in which we process your personal information (i.e., require us to continue to store your personal data, but not otherwise process it without your consent). Such circumstances include:
    • where you think the personal data we hold about you is inaccurate, processing can be restricted while it is being rectified;
    • where you object to our processing (which is being carried out on the grounds that it is necessary in the public interest or for our legitimate interests) processing can be restricted while we determine whether such grounds override your interests;
    • where processing is unlawful, but you oppose the erasure and request restriction of your data instead; and
    • where we no longer need the personal data, but you require the data in order to establish, exercise or defend a legal claim, our processing can be restricted.
  • Destruction. You may ask to have the personal data on your account deleted or destroyed. We will try to do so promptly, and, to the extent possible, we will inform anyone who has received your personal information of your request. However, we must keep track of certain transaction information, such as past purchases/investments and similar information, for legal compliance purposes, so we may not be able to fully delete your information in certain circumstances until we achieve the legal purpose of processing such data.
  • Receiving/transferring your personal data. In certain circumstances, and subject to applicable law, you may also ask us to send you the personal data we hold on you in an electronic, structured and user-friendly format, or you may ask us to send this data to another entity.
  • Object. Where we are processing your personal information without your consent to pursue our legitimate interests, you may object to us processing your personal data. In particular, where we are using your personal data to contact you for marketing purposes, you may object to such processing at any time.
  • Automated decision-making. You have the right to be informed of any automated decision-making, including profiling, used in connection with your personal data, and we will provide information about the logic we apply, as well as the significance and consequences of such processing.

For any of the requests listed above, please contact us using our contact details at the end of this Privacy Notice. We will make reasonable efforts to respond promptly and within the indicated timelines. Our response to such requests may be limited to information under our direct control.

You will not have to pay a fee to access or correct your personal data.

7. SECURITY

  • Security measures. We limit access to personal data that we collect about you to our employees and third-party agents, who we reasonably believe need to have access to your information to provide you with the information or services you request from us. We have security measures in place to help protect against the loss, misuse and alteration of the information under our control. While we cannot guarantee that loss, misuse or alteration to personal data will not occur, we ensure that our systems adhere to market security standards so as to help safeguard against such occurrences. Where information is provided to us via our website, in certain areas the information passed between your browser and our system is encrypted with secure sockets layer (“SSL”) technology to create a protected connection between you and our Site to ensure confidentiality. However, no method of transmission over the Internet, or method of electronic storage is 100% secure. We will use commercially acceptable means to protect your personal data, but we cannot guarantee its absolute security. If you have any questions about our security, you can email us.
  • Children’s privacy protection. Investcorp does not target, and its websites are not intended for, children under the age of 16. Investcorp will not knowingly collect personal data from children and will delete such data upon discovery. Where Investcorp requires personal data pertaining to children for the purpose of providing a service, the consent of an adult with parental responsibility for that child will be required.

8. OPTING OUT

If you do not wish to receive certain communications from us, you may opt out by: (1) declining the service offered or (2) informing us that you no longer wish to receive such communications. We will comply with such requests unless such communications from us are required by law or do not require your consent under applicable laws. Your consent does not form a condition of providing a service or a benefit from us, but your opting out may restrict our ability to provide you with the full extent of our services.

9. CONTACT DETAILS

If you are unhappy about how we have handled your personal information you can contact us and we will investigate the matter and report back to you.

If you are still not satisfied after our response, or believe we are not using your personal information in line with the law, you have the right to complain to the Saudi Data & AI Authority (https://sdaia.gov.sa/) or other governmental authority or agency responsible for managing and protecting personal data in the jurisdiction where you are based, or in the jurisdiction where you think the breach occurred.

If you’d like any more details, or you have comments or questions about our privacy notice, contact us by email or write to us: compliance@investcorp.com

Investcorp International Limited
Investcorp House,
48 Grosvenor Street,
London W1K 3HW

10. CHANGES IN THIS PRIVACY NOTICE

Any changes we make to this Privacy Notice in the future will be posted on this page. We reserve the right to modify this Privacy Notice at any time. If we make material changes to this policy, we will notify you by email, or by means of a notice on our website home page.

assets/icons/arrow shitestroke2 Created with Sketch.