Appendix A

Privacy Notice and Policy

This privacy policy and notice (“Privacy Statement”), together with any more specific privacy notices indicated below and any terms and conditions that are applicable to your relationship with Penjing, sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us in the course of your use of our investor Portal (“Penjing Investor Portal”, which term shall include the following websites the destination links to which are included in the portal: (i) the Penjing corporate website (www.penjing-am.com), (ii) the Professional Investors Suitability Assessment form hosted by Cognito Form, and (iii) the Microsoft sign-in pages for authorised internal staff).

When used in this Privacy Statement, (i) “Penjing”, “we”, “our” and “us” mean Penjing Asset Management (Asia) Limited and all of its Affiliates, and “Affiliate” of a person means any other person that directly or indirectly is controlled by or controls such person or is under common control with such person, and (ii) “you” and “user(s)” mean a person who has agreed to the Privacy Statement for himself or, as the case may be, for himself and his client(s).

This notice applies to you if you are a client or prospective client of Penjing.

Except as otherwise indicated below, Penjing is a data controller in respect of your personal data for the purposes of data protection law, such as the European Union’s General Data Protection Regulation and the Personal Data (Privacy) Ordinance of Hong Kong (“PDPO”). Penjing is responsible for ensuring that it uses your personal data in compliance with data protection law. In respect of your investment in fund(s) managed by Penjing, please refer to the respective subscription agreement(s) for details of the relevant privacy policy and notice.

The Penjing Investor Portal utilizes the service and platform provided by a third-party web-based virtual Investor Portal service provider. Where personal information is collected from you in the course of your use of the Penjing Investor Portal, details of the privacy notice and policy applicable to such third-party service provider may be found on the relevant website. Please contact ir@penjing-am.com for details of the current service provider. Penjing does not accept any responsibility or liability for such policy and notice.

We process your personal data for the purposes as disclosed to you only:

• if you have consented to us doing so;
• if we need it to perform a contract which we have entered into with you;
• if we need it to comply with a legal or contractual obligation; or
• if we have a legitimate interest which is not overridden by your interests or fundamental rights and freedoms. Such legitimate interests may be in connection with Penjing’s asset management, investment advisory and due diligence business and Penjing’s offices security and safety.

Additionally, Penjing will process personal data fairly, and in particular, where applicable Penjing will ensure that your personal data is:

• used lawfully, fairly and in a transparent way;
• collected only for valid purposes that Penjing has clearly explained and not used in any way that is incompatible with those purposes;
• relevant to the purposes notified to you and limited only to those purposes;
• accurate and kept up to date;
• kept only as long as necessary for the purposes Penjing has told you about; and
• kept securely.

The website and cookies

The Penjing Investor Portal may contain links to other websites or services of interest. However, if you use one of these links to leave the Penjing Investor Portal, you should note that we do not have any control over that other website or service. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting a linked website or service and such websites or services are not governed by this Privacy Statement. You should always exercise caution and review the privacy policy applicable to the website or service in question.

What cookies are

A cookie is a small file which asks permission to be placed on your computer or device. Once you agree, the file is added and the cookie helps a web application respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences. Cookies can be “session” cookies (deleted when you close your browser) or “persistent” cookies (stored for a defined period).

Cookies we use on the Penjing Investor Portal

The Penjing Investor Portal uses strictly necessary cookies only. These are required for security and sign-in. They include session cookies that keep you authenticated while you use the Portal. Examples of what these cookies do include remembering that you are signed in, protecting your session from unauthorised use, and supporting secure navigation between Portal pages.

We do not use optional analytics, advertising or “traffic log” cookies on the Penjing Investor Portal to analyse browsing behaviour for marketing or statistical profiling.

Managing cookies

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting in order to decline cookies if you prefer to. Because our strictly necessary cookies are required for the Portal to function, declining cookies may prevent you from signing in or using secure areas of the Penjing Investor Portal.

For further details on cookies and how to manage them, we recommend that you visit the All About Cookies website.

Server logs (not cookies)

Separately from cookies, our servers record technical and security information when you use the Penjing Investor Portal — for example IP address, browser type, pages or documents accessed, and timestamps. We use this information for security, fraud prevention, troubleshooting and compliance auditing (including logs of document views, downloads and prints). This processing is performed on our systems and is not the same as placing an analytics or traffic log cookie on your device.

Personal information to be collected

The personal information that we may obtain about you includes, without limitation:

• Contact Details: Information such as your name, postal address, contact numbers, nationality/place of incorporation, e-mail address and other contact details.
• Payment Data: Information necessary for us to process payments such as account name and number, security code number and other billing details.
• Tax Details: Information such as your tax identification number, tax residency and other details pertaining your tax status.
• Financial Details: Information such as source of funds and other financial information.
• Other Compliance Details: Information we are legally required to collect for compliance purposes such as “Know Your Client” checks, details relevant to international sanctions and restrictive measure, litigations, and any other details that may impact our ability to act.

This information may come from sources such as executed subscription forms, written, electronic or verbal correspondences between you and us and platforms which allow us to access publicly available information.

If you are a natural person, this will affect you directly. If you are a corporate entity (including, for these purposes, legal arrangements such as trusts or exempted limited partnerships) that provides us with personal data on individuals connected to you for any reason in relation to your dealing with us, this will be relevant for those individuals and you should transmit this document to such individuals or otherwise advise them of its content.

Additional information collected through the Penjing Investor Portal

Depending on how you use the Penjing Investor Portal, we may also collect:

• Account and identity data — name, email address, login credentials (stored in hashed form), role (investor or internal staff), and authentication provider (portal password or, for authorised staff, Microsoft sign-in).
• Security data — two-factor authentication (2FA) settings, email verification status, session identifiers, password reset tokens, and records of sign-in activity (including last login time).
• Onboarding and compliance data — records that you have reviewed and accepted required legal agreements (such as the non-disclosure agreement, privacy policy, terms of use and professional investor declaration), including the time of acceptance.
• Investor access data — which fund products you are permitted to access for restricted document levels, and saved portfolio configurations you create in the Portal.
• Content interaction data — logs of when you view, download or print offering documents and newsletters made available through the Portal, including the document concerned, date and time, and technical information such as IP address and browser user-agent string.
• Communications — if we send you service emails (for example account invitations, password resets or email verification), we process your email address and the content required to deliver those messages.
• Support enquiries — if you contact investor relations by email, we process the information you choose to provide.

We do not intentionally collect sensitive personal data through the Penjing Investor Portal. Please do not submit sensitive personal data unless we specifically request it.

Purposes and legal basis for processing

Your personal data may be processed by Penjing or a third-party (or any of their Affiliates, agents, employees, delegates or sub-contractors) for the following purposes:

Performance of your contract with us

• Managing and administering your holdings in the funds managed by Penjing, including assessing and processing applications, communicating with you about your holdings and account related activities on an on-going basis;
• To carry out due diligence in order to achieve a sufficient level of knowledge and understanding of a prospect or client and its business, management and employees;
• To provide investment advisory, due diligence and risk advisory services;
• To manage and maintain our relationships with you and for ongoing customer service;
• To enforce or defend Penjing’s, as well as funds managed by Penjing’s rights, itself or through third parties to whom it delegates such responsibilities;
• To comply with any applicable legal, tax or regulatory obligations on Penjing or third-party service providers, which derive from anti-money laundering and counter-terrorism legislation.

Comply with legal and regulatory obligations

• In order to carry out anti-money laundering checks and related actions including sharing data with police, law enforcement, tax authorities or other government and fraud prevention agencies where we have a legal obligation, including screening transactions, reporting suspicious activity and complying with production and court orders;
• To report tax related information to tax authorities;
• To investigate and resolve complaints and manage contentious regulatory matters, investigations and litigation;
• To monitor electronic communications for investigation and fraud prevention purposes, crime detection, prevention and investigation.

General business management

The day to day running and management of Penjing including to:

• monitor, maintain and improve the processes, information and data, technology and communications solutions and services used by Penjing;
• perform general, financial and regulatory accounting and reporting;
• to pursue the legitimate interests of Penjing;
• to build up Penjing’s marketing profiles, aid strategic development and analyze/audit usage of the Penjing Investor Portal;
• to provide you with personalized service, processing client orders, registrations and enquiries, conducting market research survey;
• protect our legal rights and interests including screening transactions for fraud prevention and anti-money laundering purposes.

Penjing Investor Portal operations

In connection with your use of the Penjing Investor Portal, we also use personal data to:

• operate and maintain the Penjing Investor Portal;
• authenticate users and protect accounts (including 2FA and session management);
• control access to confidential fund information, offering documents and newsletters;
• apply watermarks and access restrictions to documents in accordance with confidentiality settings;
• maintain audit trails of document access for compliance and security;
• manage investor onboarding (password change, email verification, legal acceptances); and
• detect, prevent and investigate security incidents, unauthorised access or misuse.

Marketing

Penjing may, if you have provided us with your consent, contact you by mail, telephone, fax, e-mail or other electronic messaging service with offers of Penjing’s other products and services, and may provide you with such documents, materials, news, training or events that Penjing may deem of interest to you. If you do not wish to receive such information from Penjing, or you have changed your mind, please email your wishes to ir@penjing-am.com. Penjing will never pass your contact details on to a third party for direct marketing purposes.

Others

Should we wish to use personal data for other specific purposes (including, if applicable, any purpose that requires your consent), we will contact you.

Recipients of data and international transfer of data

Penjing and the third-party service providers may disclose your personal information as follows:

• to their Affiliates and third-party service providers engaged in connection with the oversight, safekeeping, administration, distribution or operation of Penjing, funds managed by Penjing and the Penjing Investor Portal, in order to process the data for the above mentioned purposes. Such parties include service providers who may either process personal data on Penjing's behalf or for their own lawful purposes in connection with services provided to Penjing or funds managed by Penjing; or
• to competent authorities (including tax authorities), courts and bodies as required by applicable law or requested by such entities or to Affiliates for internal investigations and reporting. This may include the Cayman Islands Monetary Authority and the Cayman Islands Tax Information Authority and they, in turn, may exchange this information with foreign authorities, including tax authorities.

The disclosure of personal information to the third parties set out above may involve the transfer of data to the USA and other jurisdictions outside the European Economic Area (“EEA”) or outside the Cayman Islands. Such countries may not have the same data protection laws as your jurisdiction. We have put terms in place to ensure that your information is adequately protected and your privacy respected in the case of such a transfer.

In connection with the Penjing Investor Portal, personal data may also be processed by infrastructure and service providers including Amazon Web Services (cloud hosting, file storage and email delivery, primarily in the Asia Pacific (Singapore) region) and Microsoft (identity verification for authorised internal staff sign-in via Microsoft Entra ID).

Retention period and data security

Penjing will retain your personal information for a minimum period of 7 years from the date on which your relationship with Penjing terminates, or for as long as required for Penjing or the third-party service providers to perform the services or comply with applicable legal/regulatory obligations.

Penjing and its duly authorised Affiliates and/or delegates shall apply appropriate technical and organisational information security measures designed to protect against unauthorised or unlawful processing of personal data, and against accidental loss or destruction of, or damage to, personal data provided to it.

In connection with the Penjing Investor Portal, such measures include encrypted connections (HTTPS), access controls, password hashing, optional 2FA, document watermarking, and logging of document access. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

Penjing and/or the third-party service providers shall notify you of any personal data breach that is reasonably likely to result in a risk to the interests, fundamental rights or freedoms of either you or those data subjects to whom the relevant personal data relates.

Consequences of not providing required data

Where Penjing or a third-party service provider requires your personal information to comply with anti-money laundering or other legal requirements, failure to provide this information means Penjing may not be able to accept you as a client and/or may be unable to process or release your investment in funds managed by Penjing. This may result in Penjing terminating its relationship with you. We will tell you when we ask for your information whether it is a statutory or contractual requirement to give us the information and the consequences of not providing the information.

Data subject rights

You have various rights in relation to your personal information, including the right to request access to your personal information, correct any mistakes on our records, erase or restrict records where they are no longer required, object to use of personal information based on legitimate business interests, ask not to be subject to automated decision making if the decision produces legal or other significant effects on you.

Under the PDPO, you may also have the right to lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong.

We will respond to your request in writing, or orally if requested, as soon as practicable and in any event not more than within one month after receipt of your request. In exceptional cases, we may extend this period by two months and we will tell you why. We may request proof of identification to verify your request. For more details in relation to your rights, including how to exercise them, please contact us — refer to the “How to contact the company” details below.

If you would rather not receive information from us or would like to be taken off our database, just let us know by contacting us — refer to the “How to contact the company” details below. Please be aware that there may be circumstances where we need to keep your details on the database (for instance, to enable us to provide services to our investors).

How to contact Penjing

If you have any questions about our use of your personal information, please contact us at ir@penjing-am.com.

Penjing Asset Management (Asia) Limited

11-12/F, Chung Nam House
59 Des Voeux Road Central, Central, Hong Kong

This document combines Penjing’s firm-wide privacy notice and policy with supplementary information for the Penjing Investor Portal.