Privacy Policy

1. Who this policy covers

Deep Community Capital or one of DCC’s subsidiaries (together “DCC”), operates the DCC platform. This policy describes how DCC handles personal information collected through the DCC platform, including any customer accounts, the personal survey and roadmap, the client profile, and identity verification. When the services of a registered advisor are used on behalf of DCC, this policy will apply to that advisor as well.

2. What we collect

DCC will collect, use, disclose and retain personal information to the extent necessary to fulfil the purpose for which the information was collected, and any new purpose that has been disclosed to clients or prospective clients. In general, personal Information will only be used and disclosed for the purposes for which it was collected or as permitted or required by regulation or law. Examples of the personal information collected are as follows:

When an account is created: DCC collects a name, email address, phone number, postal address, and a login identifier.

During the investor survey: whether the person reports themselves as an accredited investor, risk tolerance, time horizon, impact preferences and weightings, and a planned investment amount.

Compiling an investor profile: middle name, a separate mailing address where it differs, date of birth, employment description, citizenship - and where applicable - foreign country residence, investment experience, impact-investing experience, annual income, net worth, adviser relationship, and the confirmed investment amount, strategy and themes.

A taxpayer identification number. Held in a separate table from the rest of the profile, encrypted at rest with a versioned key, with only the last four digits stored in readable form.

Identity verification results. A status, a verification timestamp, the provider's case reference, and the outcome of watchlist screening.

Accreditation evidence. Documents the investor uploads, stored under restricted access with a content hash.

Signed investment documents, and a record of the values the platform supplied to the signing service for them. That record is not a record of what appears on the executed document; only the document itself is.

Records of decisions about the investor — compliance clearance decisions and their written reasons, accreditation decisions, send authorizations, and an access log for the sensitive tax record.

Screening results are stored with personal data stripped. The platform refuses to store a screening payload that is anything other than status and reference metadata, and specifically refuses to store one containing a taxpayer identifier. This is enforced in code, not by convention.

Executed documents are archived to object storage under DCC's control.

3. Use of Third-Party Providers

DCC utilizes independent service providers and requires its service providers to protect personal information to the same degree as information in the possession of DCC. For example:

Identity verification is performed by third-party providers, not by DCC. The investor enters their identifying details, including the last four digits of their taxpayer identification number, directly into provider’s own window. DCC does not transmit that number, in whole or in part, to provider; the platform sends provider a derived, non-personal identifier that allows the case to be matched back to the investor without revealing who they are.

Document photographs and selfies. The provider may be configured to ask an investor who fails a data-source check to photograph an identity document and take a selfie. In this instance, the images would be collected and held by provider; DCC would not receive them. Alternatively, DCC may collect such information themselves through other means, recorded as an offline verification.

Signed documents are prepared and signed through providers such as DocuSign. The taxpayer identification number is never sent to such a provider and is never prefilled into a document by DCC.

4. Why we collect it

To assist individuals with their investment journey by providing a roadmap; to determine whether someone is eligible to invest; to verify identity and screen against sanctions and watchlists; to prepare, deliver and execute investment documents; to maintain the records DCC or any of its affiliates are required to keep; and to respond to inquiries. Personal information is used only for the purpose for which it was collected, or as otherwise permitted or required by law. DCC does not sell personal information and does not share it for advertising.

5. Compliance and Retention

The Chief Compliance Officer (“CCO”) is responsible for DCC’s overall compliance with any applicable laws, regulations, and standards governing personal information in its possession. All inquiries or concerns regarding the use of personal information, including information that has been transferred by DCC to a third party, must be directed to the CCO.

DCC may rely on an individual’s provision of information as implied consent to the collection and use of their personal information. Subject to legal requirements and reasonable notice, clients may withdraw their consent to the use of their personal information. However, this may prevent DCC from continuing to provide services.

Personal information will be retained for five years following the end of the client relationship or longer where required by law or regulation. When personal information is no longer required, all documentation will be destroyed in a manner commensurate with its sensitivity. DCC has a separate Data Retention and Deletion Policy.

6. Access, correction and deletion

An investor may ask what personal information DCC holds about them and may ask for it to be corrected. DCC will respond in a reasonable timeframe. Where a record must be retained by law or regulation, or forms part of the record of a decision DCC has made about an investment, it may not be possible to delete it prior to the required period for record retention.

7. Security

DCC is committed to protecting the confidentiality of personal information in its possession. Personal information is transmitted over encrypted connections and held in access-controlled databases. The taxpayer identification number is encrypted at rest with a versioned key and stored separately from the rest of the investor profile, with every access recorded in a log that cannot be altered. Internal access to sensitive records is limited to staff whose role requires it and is enforced by the platform rather than by policy alone. No system is perfectly secure, and DCC cannot represent that it is.

8. Children

The platform is not directed to anyone under 18 and DCC does not knowingly collect personal information from anyone under 18.

9. Changes to this policy, and how to contact us

DCC will post any updated policy at this address and change the date at the top. Questions about this policy, or requests concerning personal information, may be sent to legal@deepcommunitycapital.com.