Privacy Policy

Last updated: June 2026

3Pine Capital S.à r.l. — Version 3.0 — June 2026

1. Background

3Pine Capital S.à r.l. (“3Pine Capital”, “we”, “us”, or “our”) understands that your privacy is important and that you care about how your personal data is used and protected. We respect and value the privacy of all individuals who visit our website www.3pine.capital (the “Site”), register as investors, undergo identity verification, and/or engage with our tokenised securities platform and products.

This Privacy Policy describes how we collect, use, store, process and share your Personal Data through your use of the Site and our services. It is important that you read this Privacy Policy together with any other privacy notices or fair processing notices we may provide on specific occasions when we are collecting or processing Personal Data about you so that you are fully aware of how and why we are using your data. This Privacy Policy supplements other notices and is not intended to override them.

Please read this Privacy Policy carefully and ensure that you understand it. By continuing to use the Site and our services, you accept this Privacy Policy.

2. Information About Us

The data controller is:

3Pine Capital S.à r.l.
A private limited liability company (société à responsabilité limitée) incorporated under the laws of the Grand Duchy of Luxembourg, registered with the Luxembourg Trade and Companies Register (RCS) under number B 307143.
Registered address: 1, rue Jean Piret, L-2350 Luxembourg, Grand Duchy of Luxembourg.
Email: info@3pine.capital

3. Scope of This Policy

This Privacy Policy applies to Personal Data collected and processed in connection with: (i) your use of the Site; (ii) your investor onboarding and account registration with 3Pine Capital; (iii) our compliance with applicable anti-money laundering (“AML”), know-your-customer (“KYC”) and counter-terrorism financing (“CTF”) obligations under the Luxembourg Law of 12 November 2004 on combating money laundering and terrorist financing, as amended, and related regulations; (iv) our obligations as a securitisation vehicle under the Luxembourg Securitisation Law of 22 March 2004, as amended; and (v) our obligations in connection with the issuance of tokenised notes.

The Site may contain links to third-party websites. We have no control over how your data is collected, stored or used by other websites and we advise you to check their privacy policies before providing any data to them.

4. Key Definitions

As used in this Privacy Policy:

“Personal Data”: any information relating to an identified or identifiable natural person as defined in Article 4(1) of Regulation (EU) 2016/679 (“GDPR”).
“Processing”: any operation or set of operations performed on Personal Data as defined in Article 4(2) GDPR, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, restriction, erasure or destruction.
“Data Protection Legislation”: the GDPR, the Luxembourg Law of 1 August 2018 on the organisation of the Commission nationale pour la protection des données (“CNPD Law”), and any applicable implementing legislation, as amended from time to time.

5. Personal Data We Collect

We collect the following categories of Personal Data, depending on the nature of your interaction with us and the services you use:

Identification Data: first name, maiden name, last name, username or similar identifier, title, date of birth, gender, nationality, identification numbers (passport number, national identity card number, driver’s licence number), government-issued identity documents, images and scans collected for identity verification, and biometric data.
Contact Data: residential address, billing address, telephone numbers, email address.
Correspondence Data: account opening information, customer support communications, and information provided in correspondence with us.
Financial Data: bank account information, bank identifier codes, payment card details, source of funds and wealth information provided during investor onboarding.
Location Data: information about the location of your device, including IP address and geolocation data.
Marketing and Communications Data: your preferences in receiving marketing from us, your communication preferences, and opt-in/opt-out records.
Profile Data: username and password, feedback and survey responses.
Technical Data: internet protocol (IP) address, domain name, hardware and system activity, login data, browser type and version, time zone settings, browser plug-in types, operating system and platform, and other technology information relating to devices used to access our Site.
Transaction Data: order activity, subscription amounts, redemptions, distributions received, account balances, and dates and times of relevant transactions.
Usage Data: information about how you use our Site, products and services.
Voluntary Data: information collected from time to time through surveys or upon your request, to enable us to improve our services or assess the wider needs of our users, subject to your specific consent.

Information about criminal convictions and offences. We may receive information about criminal convictions and offences when we perform compliance checks in order to fulfil our obligations under applicable AML/CTF legislation and to prevent fraudulent or unlawful acts. Processing of such data is carried out solely for compliance purposes.

Consequences of failing to provide Personal Data. Where we need to collect Personal Data by law or regulation — including for AML/KYC verification purposes — or under the terms of a contract with you, and you fail to provide that data when requested, we may be unable to open your investor account, accept your subscription, or continue to provide services to you. We will notify you if this is the case at the time of the request.

6. How We Collect Your Personal Data

We use the following methods to collect data from and about you:

Direct interactions: You may give us your Identification, Contact, Financial, Correspondence, Marketing and Profile Data by filling in forms, completing our onboarding process, or by corresponding with us by post, telephone, email or otherwise. This includes Personal Data you provide when you: (i) apply for or subscribe to our products or services; (ii) create an investor account; (iii) provide information to verify your identity and meet our AML/KYC obligations; (iv) execute a subscription agreement; (v) subscribe to our publications or request marketing materials; (vi) enter a competition, promotion or survey; or (vii) give us feedback or contact us.
Automated technologies or interactions: As you interact with our Site, we automatically collect Technical and Usage Data about your equipment, browsing actions and patterns. We collect this Personal Data by using cookies, server logs and other similar technologies. Please see our Cookie Policy for further information.
Third parties and publicly available sources: We may receive Personal Data about you from various third parties and public sources, including: (i) Technical Data from analytics providers such as Google; (ii) Contact, Financial and Transaction Data from payment service providers and account banks; (iii) Identity and Contact Data from KYC and identity verification service providers; (iv) sanctions and adverse media screening data from compliance screening providers; and (v) publicly available registries and databases.

7. How We Use Your Personal Data

We will only use your Personal Data when the law allows us to. Most commonly, we will use your Personal Data in the following circumstances:

Where it is necessary for the performance of a contract to which you are party, or in order to take steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).
Where it is necessary for compliance with a legal obligation to which we are subject, including AML, KYC, CTF, sanctions screening, and reporting obligations (Article 6(1)(c) GDPR).
Where it is necessary for the purposes of our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests (Article 6(1)(f) GDPR).
Where you have given your consent (Article 6(1)(a) GDPR). We do not rely on consent as the primary basis for core service delivery. We will obtain your consent before sending direct marketing communications and you may withdraw consent at any time.

We have set out below a description of all the ways we plan to use your Personal Data, and which legal bases we rely on to do so.

Purpose / Activity	Type of Data	Lawful Basis
To register you as a new investor and open your account.	(a) Identification (b) Contact (c) Financial	Performance of a contract with you (Art. 6(1)(b) GDPR).
To carry out AML, KYC, CTF and sanctions screening checks in connection with your onboarding and throughout the relationship.	(a) Identification (b) Contact (c) Financial (d) Transaction (e) Criminal convictions data (where applicable)	Legal obligation (Art. 6(1)(c) GDPR);
To deliver our products and services, including processing subscriptions, managing your investor account, and administering distributions and redemptions.	(a) Identification (b) Contact (c) Financial (d) Location (e) Profile (f) Transaction	(a) Performance of a contract (Art. 6(1)(b) GDPR). (b) Legal obligation (Art. 6(1)(c) GDPR).
To verify your identity, prevent and detect fraud and unlawful activities.	(a) Identification (b) Contact (c) Financial (d) Transaction (e) Usage	(a) Performance of a contract (Art. 6(1)(b) GDPR). (b) Legitimate interests — safeguarding our services (Art. 6(1)(f) GDPR). (c) Legal obligation (Art. 6(1)(c) GDPR).
To manage our relationship with you, including notifying you about changes to our terms, privacy policy, or products.	(a) Identification (b) Contact (c) Profile (d) Marketing and Communications	(a) Performance of a contract (Art. 6(1)(b) GDPR). (b) Legal obligation (Art. 6(1)(c) GDPR). (c) Legitimate interests — keeping our records updated (Art. 6(1)(f) GDPR).
To administer and protect our Site, including troubleshooting, data analysis, testing, system maintenance and security.	(a) Identification (b) Contact (c) Technical	(a) Legitimate interests — running our business and IT infrastructure, preventing fraud, network security (Art. 6(1)(f) GDPR). (b) Legal obligation (Art. 6(1)(c) GDPR).
To use data analytics to improve our Site, products and services, marketing, customer relationships and experiences.	(a) Technical (b) Usage (c) Voluntary	Legitimate interests — defining types of customers, keeping our Site relevant, developing our business (Art. 6(1)(f) GDPR).
To deliver relevant website content and communications to you and measure the effectiveness of our communications.	(a) Identification (b) Contact (c) Profile (d) Usage (e) Marketing and Communications (f) Technical	Legitimate interests — studying how customers use our products/services, developing our business, informing our marketing strategy (Art. 6(1)(f) GDPR).
To send you marketing communications about our products, services and tokenised securities offerings, where you have opted in.	(a) Identification (b) Contact (c) Marketing and Communications	Consent (Art. 6(1)(a) GDPR).
To comply with our reporting obligations to CSSF, CNPD, and other competent authorities.	(a) Identification (b) Contact (c) Financial (d) Transaction	Legal obligation (Art. 6(1)(c) GDPR).

Marketing

With your permission and/or where permitted by law, we may use your Personal Data for marketing purposes, including contacting you by email with information, news and updates on our products and services. You will not be sent any unlawful marketing or spam. We will always obtain your express opt-in consent before sharing your Personal Data with third parties for marketing purposes and you will be able to opt out at any time by following the opt-out links in any marketing message sent to you or by contacting us.

Opting out of marketing will not affect your receipt of non-marketing communications such as subscription confirmations, investor reports, account updates, or other notices.

Change of Purpose

Note that we may process your Personal Data for more than one lawful ground depending on the specific purpose for which we are using your data.

We will only use your Personal Data in accordance with the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us. If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your Personal Data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

8. Disclosures of Your Personal Data

We may share your Personal Data with the following categories of recipients:

Operational service providers: In order to deliver our services to you, we will need to share your Personal Data with third parties who provide us with tools and services including onboarding, professional advice, data storage, accounting, invoicing, advertising and marketing, IT, security and fraud detection, and communication channels.
Identity verification and KYC/AML compliance providers: In order to prevent, detect fraud and comply with our legal obligations, we will need to share your Personal Data with third party identification verification service providers.
Payment service providers and account banks: In order to process subscription payments, distributions and redemptions, we share relevant Personal Data with our account bank, e-money token issuers and payment service providers.
Placement agents and distributors: In connection with the distribution of products, we may share relevant investor identification and eligibility data with our placement agents, who are subject to their own AML/KYC and data protection obligations.
Professional advisers: Including lawyers, auditors, tax advisers and other professional service providers who require access to Personal Data in the course of providing services to us.
Law enforcement, regulators and government authorities: We may need to share your Personal Data with law enforcement agencies or government officials. We will only do this when we are required to do so by court order, formal request, specific regulation, or when we believe in good faith that sharing your Personal Data will prevent financial loss, physical harm, or we are obligated to report suspicious and illegal activities.
Third parties in business transactions: In the event of a sale, transfer, merger, or restructuring of our business or assets, Personal Data may be transferred to the relevant third party, who will be required to use it in accordance with this Privacy Policy.

We require all third parties to respect the security of your Personal Data and to treat it in accordance with applicable law. We do not permit third-party service providers to use your Personal Data for their own purposes.

9. Intra-Group Sharing of Personal Data

We may share your Personal Data within the Upwood group of companies for legitimate business purposes, including operational efficiencies, service and product delivery, and to meet applicable legal and regulatory obligations. We ensure your Personal Data is protected by requiring all group companies to follow the same standards when processing your Personal Data.

All intra-group transfers of Personal Data are conducted on a lawful basis, such as with your consent, where necessary for the performance of a contract, in compliance with legal obligations, or to further the legitimate business interests of the group. In all cases, we ensure that these interests are balanced against your fundamental rights and freedoms.

To protect your Personal Data, we always employ appropriate safeguards for all intra-group transfers, as required by data protection laws.

10. International Transfers

Some of our service providers are located outside the European Economic Area (“EEA”). When transferring data across borders, we take measures to comply with applicable data protection laws related to such transfers.

If you are located in the European Economic Area (“EEA”), the UK, or Switzerland, we rely on the Standard Contractual Clauses (“SCCs”) to provide an adequate level of data protection for the transfer of your Personal Data from the EEA, the UK, or Switzerland, where the country of import is not deemed adequate under applicable law.

11. Data Security

We have implemented appropriate technical and organisational security measures to protect your Personal Data against accidental loss, unauthorised use, access, alteration or disclosure. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

12. Data Retention

We will retain your Personal Data only for as long as reasonably necessary to fulfil the purposes for which it was collected, including satisfying any legal, regulatory, tax, accounting or reporting requirements.

In determining the appropriate retention period, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, and applicable legal requirements.

In particular:

AML/KYC records: we retain identity verification and transaction monitoring records for a minimum of five (5) years following the end of the business relationship or the date of an occasional transaction.
Contract and investor records: we retain records relating to investment transactions and contractual relationships for the duration of the relationship and for a further period of ten (10) years, or such longer period as required by applicable law or the terms of the relevant instruments.
General business records: we retain other Personal Data for a period of five (5) years from collection, unless a longer period is required or justified.

We may retain your Personal Data for a longer period in the event of a complaint, regulatory investigation, or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.

13. Your Legal Rights

Under the Data Protection Legislation, and subject to applicable conditions and limitations, you have the following rights in relation to your Personal Data:

Right of access (Article 15 GDPR): To request a copy of the Personal Data we hold about you and to verify that we are lawfully processing it.
Right to rectification (Article 16 GDPR): To request correction of any inaccurate or incomplete Personal Data we hold about you.
Right to erasure (Article 17 GDPR): To request deletion of your Personal Data where there is no good reason for us to continue processing it. Note that this right may be subject to limitations where processing is required for compliance with legal obligations (including AML/KYC retention requirements) or for the establishment, exercise or defence of legal claims.
Right to object (Article 21 GDPR): To object to processing of your Personal Data where we rely on legitimate interests as the legal basis, or where we process your Personal Data for direct marketing purposes.
Right to restriction of processing (Article 18 GDPR): To request that we suspend the processing of your Personal Data in certain circumstances, for example while we verify its accuracy.
Right to data portability (Article 20 GDPR): To receive your Personal Data in a structured, commonly used, machine-readable format where processing is based on your consent or on a contract with you, and is carried out by automated means.
Right to withdraw consent: To withdraw consent at any time where we rely on consent as the legal basis for processing. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact us in writing at info@3pine.capital. We will respond to legitimate requests within one month in accordance with the GDPR. Where requests are complex or numerous, we may extend this period by a further two months and will notify you accordingly.

You will not normally be required to pay a fee to exercise your rights. However, we may charge a reasonable fee or refuse to comply with a request that is manifestly unfounded, repetitive or excessive.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

14. Data Protection Authority

The Luxembourg supervisory authority for data protection is the Commission nationale pour la protection des données (“CNPD”):

Website: https://www.cnpd.lu/
Email: info@cnpd.lu

If you are an EEA resident and believe that we have not adequately resolved your data protection concerns, you have the right to lodge a complaint with the CNPD or with the supervisory authority of your habitual residence. We would appreciate the opportunity to address your concerns first — please contact us at info@3pine.capital in the first instance.

15. Cookies

Our Site uses cookies and similar tracking technologies. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, some parts of our Site may become inaccessible or not function properly. For further information, please refer to our Cookie Policy, available on the Site.

16. Changes to This Privacy Policy

We keep this Privacy Policy under regular review and may update it from time to time, including to reflect changes in applicable law, regulatory requirements, or our business activities. Any material changes will be posted on our Site, and where required by applicable law, we will provide prior notice or seek your consent.

It is important that the Personal Data we hold about you is accurate and current. Please notify us promptly of any changes to your Personal Data during your relationship with us.

This Privacy Policy was last updated: June 2026.

17. Contact Us

For any questions or concerns about this Privacy Policy or the processing of your Personal Data, including to make a data subject access request, please contact us:

Email: info@3pine.capital
Postal address: 3Pine Capital S.à r.l., 1, rue Jean Piret, L-2350 Luxembourg, Grand Duchy of Luxembourg.