Privacy Policy of OBERSON ABELS Ltd

This privacy policy (the “Privacy Policy”) is issued by OBERSON ABELS Ltd (“OA”), Esplanade de Pont-Rouge 5, PO Box 225, 1211 Geneva 12, Switzerland. This Privacy Policy explains the lifecycle of Personal Data (as defined below) at OA and the rights of the data subjects in respect of Personal Data processed by OA.

What does the term “Personal Data” comprise?

In this Privacy Policy, the term “Personal Data” means, in respect of a physical person:

• static information, such as the name and the contact information;
• financial information, such as bank account details;
• background information, which OA collects in the course of its client onboarding process; and
• other personal information (i) provided to OA by, or on behalf of, clients of OA or (ii) generated by OA in the course of the provision of services to its clients.

Personal Data may include “sensitive personal data,” such as information pertaining to health or to administrative or criminal proceedings.

Why does OA process Personal Data?

OA processes Personal Data for the following purposes:

• the provision of legal and tax advice to clients of OA;
• the management of the business relationship with clients of OA (including billing and fee collection); and
• the compliance with legal and regulatory requirements applicable to OA.

Subject to obtaining consent, OA may process Personal Data for additional purposes, such as the dissemination of OA Legal Updates (i.e., communications in respect of legal, tax and regulatory developments), invitations to events organized by OA or other announcements related to OA. Consent may be withdrawn at any time by sending an email to dpo@obersonabels.com.

A. Lifecycle of Personal Data at OA

The lifecycle of Personal Data at OA is primarily composed of the following three steps:

Step 1 – collection of Personal Data

OA collects Personal Data:

• when OA onboards a client;
• when OA provides legal and tax advice;
• when a person browses on the website of OA; and
• when a person attends an event organized by OA.

Generally speaking, the clients of OA provide the Personal Data (about themselves or about third parties) to OA. The clients of OA are informed and accept that it is their responsibility to pass on the information contained in this Privacy Policy to any third party whom their provide Personal Data about.

That being said, it should be noted that, in certain circumstances, OA may collect Personal Data from third party sources, such as public records or third party service providers.

Step 2 – processing of Personal Data

OA takes technical and organizational measures against unauthorized access to, or processing of, Personal Data and accidental loss or destruction of Personal Data, in accordance with OA’s internal security procedures.

In principle, OA does not transfer Personal Data outside of Switzerland. However, depending on the circumstances of its mandate, OA may have to transfer Personal Data to third parties, including third parties based outside of Switzerland, for example (but not limited to) sub-contractors, other counsel or accountants, as well as third parties involved in client matters. Where OA transfers Personal Data to third parties, OA does so in accordance with applicable data protection rules and subject to its regulatory obligations. In addition, OA takes appropriate safeguards to ensure the protection of the Personal Data. Additional information on thistopicmay be obtained by sending an email to dpo@obersonabels.com.

Step 3 – retention of Personal Data

OA retains Personal Data for as long as reasonably necessary for OA (i) to fulfill the purposes mentioned above or (ii) until the data subject withdraws his/her consent, provided that OA is not permitted to continue to hold such Personal Data for another reason (e.g., to exercise and/or defend legal claims or for purposes of an investigation). Destruction of Personal Data takes place in accordance with the terms of OA’s internal data backup procedures.

B. What are the rights of a data subject in connection with his/her Personal Data?

Subject to applicable regulations, the data subject has the right to:

• access and obtain a copy of his/her Personal Data;
• request the rectification of his/her Personal Data when they are inaccurate or incomplete;
• request the erasure of his/her Personal Data, e.g., when they are no longer necessary for the purposes for which they were collected or processed, or when the data subject withdraws the consent necessary for the processing (subject to Step 3 above);
• object on legitimate grounds to the processing of his/her Personal Data;
• request the limitation of the processing of his/her Personal Data;
• receive information on the safeguards which OA may have implemented for transferring Personal Data to jurisdictions which do not ensure an adequate level of data protection (if applicable); and
• lodge a complaint with a competent data protection supervisory authority.

The data subject may also, at any time and without justification, object to the processing, by OA, of his/her Personal Data for marketing purposes.

Any question regarding the processing of Personal Data by OA may be addressed to dpo@obersonabels.com.

Version: May 2024