Privacy Policy

SCOPE AND APPLICABILITY

This Privacy Policy expresses Daemon’s commitment to the protection of personal data and describes the guidelines and procedures adopted regarding the collection, use, storage, sharing and protection of personal data.

Daemon processes personal data in accordance with applicable data protection laws and regulations, including Brazilian Law No. 13,709/18 – General Data Protection Law (“LGPD”) and, where applicable, other data protection laws and regulations, including the General Data Protection Regulation (“GDPR”) and applicable U.S. privacy requirements.

The applicability of specific data protection laws depends on the circumstances of the processing, including the location of the data subject and the nature of the relevant activities.

Terms relating to personal data processing shall have the meanings attributed to them under the applicable data protection laws.

This Privacy Policy applies to personal data collected through Daemon’s website, communications and other interactions with Daemon, as applicable.

PERSONAL DATA WE COLLECT

Daemon may collect personal data directly from data subjects, automatically through its website and electronic services, or from third parties, depending on the circumstances.

Personal data voluntarily provided to Daemon, its partners and/or agents may include:
– identification and contact information, such as first and last name, identification documents, physical address, electronic address, email address, company and professional information;
– information provided through communications with Daemon, including contact forms, emails and other communication channels;
– access credentials to services provided in a virtual environment by Daemon, where applicable; and
– any other information voluntarily provided by the data subject.

Personal data may also be automatically collected when users access Daemon’s website or electronic services, including:
– information relating to electronic devices used to access such services, including device identifiers, IP address, browser type and other technical information;
– navigation information obtained through cookies and similar technologies; and
– information regarding interaction with Daemon’s website and electronic services, such as pages or content accessed, duration of access, links used and downloads.

Daemon may also receive personal data from third parties, including partner companies, service providers, public authorities, regulators, public records and other publicly available sources, where permitted by applicable law.

Daemon does not intentionally collect sensitive personal data through its website, except where such processing is necessary and permitted under applicable law

PURPOSES OF PROCESSING

Daemon may process personal data for purposes including:
– providing its services efficiently and improving its services, products and working methods;
– operating, maintaining, protecting and improving its website and electronic services;
– communicating with data subjects and responding to inquiries and requests;
– managing relationships with clients, investors, business partners, service providers and other parties;
– complying with legal, regulatory, contractual and compliance obligations;
– responding to requests from regulatory, governmental or other competent authorities;
– protecting Daemon’s rights and interests and exercising rights in judicial, administrative or arbitration proceedings;
– maintaining information security and preventing fraud, misuse or unauthorized access;
– analyzing the use and performance of Daemon’s website and electronic services; and conducting communications, marketing or analytics activities, where permitted by applicable law and, where required, subject to consent.

LEGAL BASES OF TREATMENT

Daemon processes personal data only where there is an appropriate legal basis under applicable law.

Depending on the circumstances and applicable legislation, such legal bases may include:
– consent of the data subject, where required;
– compliance with legal or regulatory obligations;
– performance of a contract or procedures preliminary to a contract;
– exercise of rights in judicial, administrative or arbitration proceedings;
– protection of life or physical safety, where applicable;
– legitimate interests of Daemon or third parties, provided that such interests do not improperly override the fundamental rights and freedoms of the data subject; and
– other legal bases permitted under applicable data protection laws.

Where the LGPD applies, Daemon processes personal data in accordance with the principles established under Article 6 of the LGPD, including purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination and accountability.

SHARING OF PERSONAL DATA

Daemon may disclose or share personal data, as necessary and permitted under applicable law:
– with affiliates, partner companies and service providers that support Daemon’s business activities and the provision of its services;
– with third-party service providers, including technology, hosting, security and other operational providers;
– with professional advisors, auditors, accountants, consultants and compliance or legal service providers;
– with brokers, fund administrators and other service providers involved in providing investment management or related services, where applicable;
– with governmental, regulatory, judicial or administrative authorities, where required or permitted by law;
– where necessary for the establishment, exercise or defense of legal rights;
– in connection with corporate transactions, reorganizations or other changes involving Daemon, where the transfer of information is necessary for the relevant transaction or continuity of services; and
– where otherwise required or permitted by applicable law.

Personal data is shared only to the extent necessary for the applicable purpose and subject to appropriate confidentiality, security and data protection requirements.

With respect to nonpublic personal information relating to clients and investors, Daemon limits disclosure in accordance with applicable privacy requirements and its internal policies and procedures, including disclosures to affiliates and service providers that assist Daemon in providing investment advisory, transactional, administrative, accounting, compliance or operational services.

This formulation is consistent with the Compliance Manual, which expressly limits disclosure of client and investor NPPI to affiliates and third parties assisting the Firm in its advisory or transactional activities.

INTERNATIONAL DATA TRANSFERS

Daemon does not routinely transfer personal data internationally solely for the purpose of transferring such data. However, given the international nature of certain activities and the use of third-party service providers and cloud-based technologies, personal data may be processed or stored in jurisdictions other than the jurisdiction in which it was originally collected.

Where international transfers of personal data occur, Daemon adopts the measures and safeguards required under applicable data protection laws.

DATA RETENTION AND DISPOSAL

Daemon retains personal data only for as long as reasonably necessary to fulfill the purposes for which it was collected or processed, or as necessary to comply with applicable legal, regulatory, contractual, audit, compliance or security requirements.

Retention periods may therefore vary depending on the nature of the information, the purpose of processing and applicable legal or regulatory requirements.

Where permitted by applicable law, a data subject may request deletion of personal data. Such request may not result in immediate deletion where Daemon is required or permitted to retain the information, including for legal, regulatory, contractual, audit, compliance, security or dispute-resolution purposes.

When personal data is no longer required to be retained, Daemon adopts appropriate measures for its secure disposal.

The secure-disposal concept is also expressly reflected in the Compliance Manual for client and investor NPPI.

DATA SECURITY

Daemon adopts administrative, technical and organizational measures designed to protect personal data against unauthorized access, misuse, loss, alteration, disclosure or destruction.

Such measures are designed taking into account the nature of the information processed, applicable legal and regulatory requirements and appropriate information security practices.

Access to personal data is limited, as appropriate, to personnel and service providers that require access to such information for legitimate business purposes and are subject to applicable confidentiality and security obligations.

Daemon also maintains policies and procedures addressing information security, cybersecurity and the protection of nonpublic personal information.

No method of transmission or storage of information is completely secure. Accordingly, although Daemon adopts measures designed to protect personal data, absolute security cannot be guaranteed.

Where required by applicable law, Daemon will take appropriate measures in response to personal data security incidents, including notifications to competent authorities and affected data subjects when legally required.

HOLDERS’ RIGHTS AND HOW TO EXERCISE THEM

Data subjects may have rights regarding their personal data under applicable data protection laws.

Where the LGPD applies, data subjects may, subject to the conditions established by law, request:
– confirmation of the existence of processing;
– access to personal data;
– correction of incomplete, inaccurate or outdated personal data;
– anonymization, blocking or deletion of unnecessary or excessive personal data or personal data processed in violation of the LGPD;
– portability of personal data, where applicable;
– deletion of personal data processed on the basis of consent, subject to applicable legal exceptions;
– information about public and private entities with which Daemon has shared personal data;
– information about the possibility of refusing consent and the consequences of such refusal;
– withdrawal of consent, where processing is based on consent; and
– review of decisions made solely on the basis of automated processing, where applicable.

Depending on the applicable jurisdiction, data subjects may have additional rights, including rights to object to or restrict certain processing activities.

Requests relating to personal data may be submitted using the contact information provided in Section L below.

Daemon may request information reasonably necessary to verify the identity of the requesting individual before responding to a request.

COOKIES AND TRACKIING TECHNOLOGIES

Daemon’s website may use cookies and similar technologies to enable website functionality, improve the user experience and understand how the website is used.

Cookies are small files stored on a user’s device when accessing certain websites. Depending on their purpose, cookies used by Daemon may include:
– Necessary cookies: cookies that are necessary for the operation of the website and enable users to navigate and use its essential features;
– Functionality cookies: cookies that support enhanced functionality and user preferences; and
– Performance and analytics cookies: cookies that assist Daemon in understanding website usage and performance.

Where required by applicable law, non-essential cookies will be used subject to the user’s consent.

Users may manage or disable cookies through their browser settings and, where available, through the cookie management tools provided on Daemon’s website. Disabling certain cookies may affect the availability or functionality of certain website features.

CHANGES TO THE PRIVACY POLICY

Daemon may update this Privacy Policy from time to time to reflect changes in its activities, practices, technologies or applicable legal and regulatory requirements.

The current version of this Privacy Policy will be made available on Daemon’s website at https://daemoninvestments.com.

Where appropriate or required by applicable law, Daemon may provide additional notice regarding material changes to this Privacy Policy.

CONTACT US

For questions, requests or concerns relating to this Privacy Policy or the processing of personal data, please contact:

Data Protection Officer (DPO)

dataprivacy@daemoninvestments.com