PRIVACY POLICY
ARCUS & CO. PRIVATE CAPITAL AND CORPORATE ADVISERS LLP
Last updated: 7 October 2026

1. INTRODUCTION

1.1 This privacy policy explains how Arcus & Co. Private Capital and Corporate Advisers LLP ("Arcus", "we", "us" or "our") collects, uses, discloses and protects personal data in connection with (a) its website at arcusandco.com, (b) enquiries and correspondence addressed to it, (c) prospective, current and former business relationships, and (d) its corporate, commercial and transactional activities.

1.2 "Data Protection Legislation" means the UK General Data Protection Regulation (the "UK GDPR"), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR") and, where applicable, Regulation (EU) 2016/679 (the "EU GDPR"), in each case as amended or replaced from time to time. "Personal data", "processing", "controller", "processor" and related terms have the meanings given to them in that legislation.

1.3 This policy is provided for information only. It does not form part of any contract and does not modify any engagement letter, confidentiality agreement or other arrangement. Any specific privacy information given in connection with a particular engagement or transaction should be read together with this policy.

2. WHO WE ARE

2.1 Arcus is a limited liability partnership registered in England and Wales under number OC461436, with its registered office at 21 Foley Street, London W1W 6DR, United Kingdom.

2.2 Arcus is the controller of the personal data described in this policy, save where it processes personal data on behalf of another person as processor, or jointly with another controller, in which case the arrangements with, and the privacy information of, that other person will apply.

2.3 Arcus is registered with the Information Commissioner's Office under registration number [●].

2.4 Where required by article 27 of the EU GDPR, our representative in the European Union is [●].

2.5 Entities established or sponsored by Arcus for a particular transaction may act as separate controllers of the personal data they process and are responsible for that processing.

3. PERSONAL DATA WE COLLECT

3.1 Depending on our relationship with you, we may process:

(a) identity and contact data: name, title, business contact details, employer and position and, where required for verification, date of birth, nationality, signature and identity documents;
(b) professional data: qualifications, experience, directorships, ownership interests and decision-making authority;
(c) transaction data: information received or generated in connection with a proposed or actual engagement, acquisition, disposal, financing, investment, joint venture or other transaction, including due diligence materials and correspondence;
(d) compliance data: information required for identity verification and for beneficial ownership, sanctions, politically exposed person, adverse media, anti-money laundering, fraud-prevention and conflict checks, including source-of-funds and source-of-wealth information;
(e) financial data: bank and payment details, invoicing records and information on financial position or interests relevant to a transaction;
(f) communications data: emails, letters, messages, records of calls and meetings, website enquiries and marketing preferences; and
(g) technical data: IP address, browser and device information, approximate location, website usage data and cookie data.

3.2 We do not seek to collect special category data or criminal offence data. Where such data is contained in materials we receive, or arises from due diligence or compliance checks, we process it only where permitted by articles 9 and 10 of the UK GDPR (and of the EU GDPR, where applicable) and Schedule 1 to the Data Protection Act 2018.

3.3 Our website and services are not directed at individuals under the age of 18, and we do not knowingly collect their personal data.

4. SOURCES OF PERSONAL DATA

4.1 We collect personal data from you directly and from:

• the organisation you represent;
• clients, counterparties, co-investors, lenders and other transaction participants;
• professional advisers, intermediaries and introducers;
• identity-verification, sanctions-screening and compliance service providers;
• public registers (including Companies House and foreign company registries), court records and public authorities;
• publicly available professional sources.

4.2 If you provide personal data relating to another person, you confirm that you are entitled to do so and that the person has received the information required by the Data Protection Legislation.

5. PURPOSES AND LAWFUL BASES

5.1 We process personal data for the following purposes: responding to enquiries and assessing potential engagements and transactions, performing engagements and transactions, including negotiation, documentation, invoicing and record-keeping, identity, sanctions, anti-money laundering, fraud and conflict checks, complying with law and responding to courts, regulators and public authorities, establishing, exercising or defending legal claims, operating, securing and improving our website, professional communications, commentary and event invitations.

5.2 Where we rely on legitimate interests, we balance those interests against your rights and freedoms, and you may ask us for details of that assessment.

5.3 Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

5.4 Where personal data is required by law or contract and is not provided, we may be unable to establish or continue a relationship or to progress a transaction.

5.5 We do not carry out decision-making based solely on automated processing which produces legal or similarly significant effects.

6. DISCLOSURE OF PERSONAL DATA

6.1 We disclose personal data only where necessary and lawful, and on a need-to-know basis, to:

(a) our members and personnel, and entities established or sponsored by Arcus;
(b) clients, counterparties, co-investors, lenders, noteholders and other transaction participants, and their advisers;
(c) professional advisers, including lawyers, accountants, auditors, tax advisers and valuers;
(d) banks, payment service providers and insurers;
(e) service providers acting on our behalf, including information technology, hosting, email, data-room, document-management and compliance-screening providers, under written terms requiring them to protect it;
(f) courts, regulators, tax authorities, law enforcement agencies and other public authorities, where required or permitted by law; and
(g) a prospective acquirer, investor, financier or successor in connection with a corporate transaction concerning Arcus or an entity it sponsors, subject to confidentiality.

6.2 We do not sell personal data.

7. INTERNATIONAL TRANSFERS

7.1 Our activities are cross-border, and personal data may be transferred to and processed in the European Economic Area and other countries.

7.2 Where personal data is transferred from the United Kingdom, we rely on UK adequacy regulations or, where none applies, on appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Where the EU GDPR applies, we rely on an adequacy decision of the European Commission or on the EU standard contractual clauses. Transfers may also rely on a statutory derogation where permitted, including where necessary for the establishment, exercise or defence of legal claims.

7.3 You may request information on the safeguards applied to a particular transfer.

8. RETENTION

8.1 We keep personal data only for as long as necessary for the purposes for which it was collected, including legal, accounting, tax, regulatory and dispute-resolution requirements.

8.2 As a general rule, we keep:
(a) engagement and transaction records for six years after the end of the relevant engagement or transaction;
(b) compliance and due diligence records for at least five years after the end of the relevant relationship, or longer where required by law;
(c) website enquiries that do not lead to a relationship for up to 24 months;
(d) contact details used for professional communications until you object or unsubscribe; and
(e) cookie data for the periods set out in our cookie settings.

8.3 Longer retention may apply where personal data is subject to a legal hold or is required for an actual or anticipated claim. Personal data which is no longer required is securely deleted or anonymised.

9. SECURITY

9.1 We maintain appropriate technical and organisational measures to protect personal data. These include access controls, encryption where appropriate, confidentiality undertakings, secure data rooms and due diligence on service providers.

9.2 No transmission over the internet is completely secure. Please do not send confidential information through our website before a confidentiality agreement or engagement is in place.

9.3 Where a personal data breach is likely to result in a risk to individuals, we will notify the competent supervisory authority and, where required, the individuals affected.

10. YOUR RIGHTS

10.1 Subject to the conditions and exemptions in the Data Protection Legislation, you have the right to:
(a) access your personal data;
(b) have it rectified;
(c) have it erased;
(d) restrict its processing;
(e) receive it in a portable format;
(f) object to processing based on legitimate interests;
(g) object at any time to direct marketing; and
(h) withdraw consent.

10.2 To exercise a right, please contact us using the details in section 15. We may need to verify your identity. We will respond within one month, which may be extended by two further months for complex or numerous requests, and will not normally charge a fee.

10.3 Certain rights may be limited, for example where personal data is subject to legal privilege or to confidentiality obligations owed to others, or where disclosure would prejudice the prevention or detection of crime.

11. COMPLAINTS

11.1 If you have a concern about our handling of your personal data, please contact us first. We will acknowledge your complaint within 30 days and respond without undue delay.

11.2 You also have the right to complain to the Information Commissioner's Office (ico.org.uk; 0303 123 1113). If you are in the European Economic Area, you may complain to the supervisory authority of the Member State where you live or work, or where the alleged infringement took place; in Italy, this is the Garante per la protezione dei dati personali.

12. COOKIES AND WEBSITE TOOLS

12.1 Our website uses cookies which are strictly necessary for its operation and, with your consent, analytics cookies which help us understand how it is used. You may accept or decline non-essential cookies through the cookie banner and may change your choice at any time.

12.2 Our contact form uses Google reCAPTCHA to protect the website against spam and abuse. Data collected through reCAPTCHA is processed by Google in accordance with its Privacy Policy and Terms of Service.

12.3 If you contact us through WhatsApp, your communications are also processed by WhatsApp under its own terms and privacy policy.

12.4 Our website may contain links to third-party websites. We are not responsible for their content or privacy practices.

13. PROFESSIONAL COMMUNICATIONS

13.1 We may send professional communications, including commentary and event invitations, to business contacts on the basis of our legitimate interests and, where required by PECR, your consent. Each communication includes a means to unsubscribe, and you may object at any time by contacting us.

14. CHANGES TO THIS POLICY

14.1 We may update this policy from time to time. The current version, with its date, is always available on our website. Where changes are significant, we will take reasonable steps to bring them to your attention.

15. CONTACT

Arcus & Co. Private Capital and Corporate Advisers LLP
21 Foley Street, London W1W 6DR, United Kingdom
Email: partners@arcusandco.com (please mark correspondence "Data Protection")