Sommaire
Text Link

Personal Data Protection Policy

Version 2.0 – July 2026

1. Introduction

Context

Mimco Asset Management (hereinafter referred to as "Mimco AM") is committed to conducting its business in accordance with all applicable data protection laws and regulations and in compliance with the highest ethical standards.

The EU General Data Protection Regulation ("GDPR") is designed to harmonize data protection laws across Europe, with the goal of protecting and empowering all EU citizens or individuals located within the Union (regardless of their citizenship) with rights regarding the privacy of their data and reshaping how organizations in the region approach data privacy.

This policy sets out the expected conduct for Mimco AM employees and relevant third parties regarding personal data. This policy covers the collection, use, retention, transfer, disclosure, and destruction of all personal data belonging to individuals under the control of Mimco AM.

The company's management is fully committed to ensuring the ongoing and effective implementation of this policy and expects all Mimco AM employees and their third parties to share this commitment. Any violation of this policy may result in disciplinary action.

Objective

The purpose of this policy is to establish safeguards to protect personal data held, stored, or maintained by the management company, as well as personal data collected from or transferred to third parties, regardless of the format (physical or electronic). This policy is designed to:

  • Ensure the security and confidentiality of personal data;
  • Protect against any threat or risk to the security or integrity of personal data;
  • Protect against unauthorized collection, access, or use of personal data

Definitions

GDPR Lead — The person appointed by Mimco AM to be responsible for the management company's compliance with data protection regulations.

Controller — The natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Processor — A natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller (as defined in Article 4(8) of the GDPR).

Data subject — A natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to their identity.

Data protection regulations — The GDPR as well as any applicable national law or regulation regarding data protection.

Personal data — Any information relating to an identified or identifiable natural person ("data subject").

Personal data processing activity — Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Scope

This policy applies to all processing of personal data, whether carried out in electronic form (including emails and digital documents) or on paper. All staff are subject to the requirements set out in this policy and must certify that they have read and understood its content.

2. Personal Data Protection System

Mimco AM applies the "P-D-C-A" (Plan-Do-Check-Act) philosophy (see Appendix 1) to ensure that the data protection framework and the processing of personal data by the firm remain compliant with GDPR requirements.

2.1. Governance

To establish appropriate governance, Mimco AM has appointed a GDPR lead responsible for determining appropriate technical and organizational measures and implementing them within the organization.

2.1.1. GDPR Lead

The GDPR lead is responsible for implementing the personal data protection system and its continuous improvement.

The GDPR lead at Mimco AM is Alexandra NADAL. Her main responsibilities are as follows:

  • Inform and advise Mimco AM and its staff members who process data regarding their obligations under the GDPR and other data protection provisions;
  • Monitor compliance with the GDPR, other data protection provisions, as well as this policy and associated documents within the overall data protection framework;
  • Update the data protection framework and associated documents in accordance with applicable data protection regulations;
  • Provide guidance on conducting Data Protection Impact Assessments (DPIAs) and ensure their follow-up;
  • Act as a point of contact for supervisory authorities and data subjects, and cooperate with them on issues relating to processing, including in the context of prior consultations, as well as, where appropriate, consulting them on any other related matter;
  • Determine the need to make notifications to the competent supervisory authorities, carry them out, and keep them up to date, in connection with current or planned personal data processing activities;
  • Implement and operate a system to provide quick, accurate, and appropriate responses to requests from data subjects;
  • Inform management of any potential corporate, civil, or criminal sanctions that may be imposed on us and/or our staff in the event of a violation of data protection regulations;
  • Implement procedures and contractual clauses to ensure compliance with this policy by any third party that:
    • Provides personal data to Mimco AM;
    • Receives personal data from Mimco AM;
    • Has access to personal data collected or processed by Mimco AM.

2.2. Data protection "by design" and "by default"

Mimco AM ensures that all data protection requirements are taken into account and addressed during the design of new services, products, or processes, as well as during the modification or update of existing ones.

The GDPR introduces these two obligations:

  • On one hand, technical and organizational measures must be implemented both at the time of the determination of the means for processing and at the time of the processing itself, i.e., "privacy by design";
  • Furthermore, these measures must ensure that, by default, only personal data necessary for each specific purpose of the processing is processed ("privacy by default"). Mimco AM must ensure that any new design of services, products, or processes, or any change or extension to existing products, services, systems, or processes, includes a quality process in which the GDPR officer must participate. As a data controller, Mimco AM is required, in certain cases, to conduct a DPIA (Data Protection Impact Assessment) before implementing personal data processing.

2.3. Accountability principle

The GDPR places central importance on the principle of accountability for the data controller. It is therefore up to Mimco AM to take the necessary steps to implement the general principles set out by the applicable regulations and to demonstrate that these principles have been effectively respected.

Mimco AM will maintain appropriate documentation and an audit trail for each GDPR requirement to demonstrate compliance with the data protection principles set out in section 2.5. Responsibilities for maintaining this documentation are distributed among the various departments. The GDPR officer oversees this and provides the necessary guidance to meet this requirement.

2.4. Compliance controls

To ensure an adequate level of GDPR compliance, internal controls are planned and carried out in accordance with permanent and periodic control plans. At least one permanent control must be performed per year to verify that processes are followed and that operational controls are carried out and documented. Periodic controls will be performed based on a multi-year control plan.

2.5. General principles relating to the processing of personal data

This policy has been developed in compliance with the principles relating to the processing of personal data. Mimco AM adheres to the following principles when processing personal data:

  • Lawfulness, fairness, and transparency. Personal data must be processed lawfully and fairly in relation to the data subject, as well as transparently if the processing falls under the GDPR (lawfulness, fairness, transparency). We commit to informing data subjects about the processing that will be implemented (transparency), in an accurate manner (fairness), and based on a purpose defined in the GDPR (lawfulness);
  • Purpose limitation. Personal data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes (purpose limitation). Mimco AM commits to informing individuals about the use of their personal data and will limit the processing of personal data to what is strictly necessary for the processing purposes;
  • Data minimization. Personal data must be adequate, relevant, and limited to what is necessary for the purposes of the processing (data minimization). Mimco AM commits to not collecting or retaining personal data beyond what is strictly necessary for the purposes of the processing;
  • Accuracy. Data must be accurate and up to date. Mimco AM implements processes to identify and address obsolete, incorrect, or redundant personal data;
  • Retention periods. Data must be kept in a form that allows for the identification of the data subjects for no longer than is necessary for the purposes of the processing. Once the purpose of the processing has been achieved, Mimco AM commits to implementing technical and organizational measures

so that the data is deleted or subject to intermediate archiving once its retention is essential for compliance with legal obligations or for litigation or pre-litigation purposes.

  • Integrity and security of personal data. Data must be processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing, as well as against accidental loss, destruction, or damage, using appropriate technical and organizational measures (integrity and confidentiality). Mimco AM must implement appropriate technical and organizational measures to maintain the integrity and confidentiality of personal data. These measures include, but are not limited to, encryption, management of access rights to personal data, appropriate instructions and training, as well as any security measures (e.g., at the building level) to protect personal data.

2.6. Collection of personal data

The appropriate collection of personal data is a key element of our framework. Mimco AM has established the following rules for collecting personal data.

2.6.1. Data sources

In principle, personal data should only be collected from the data subject, unless the business objective requires collection from other persons or organizations. If personal data is collected from someone other than the data subject, the latter must be informed of the collection or provide prior consent.

The only exceptions to this principle are as follows:

  • The data subject has received the required information by other means;
  • The information must remain confidential due to a professional secrecy obligation;
  • A national law expressly provides for the collection, processing, or transfer of personal data. Notification to the data subject must be sent promptly, and at the latest:
  • One calendar month from the date of the first collection or recording of personal data;
  • At the time of the first communication if the personal data is used to communicate with the data subject;
  • At the time the personal data is disclosed to another recipient.

2.6.2. Information notices

Mimco AM must provide data subjects with an information notice (or equivalent) presenting the mandatory disclosures regarding the processing of personal data. Informing data subjects is a legal obligation: anyone whose personal data is processed by Mimco AM must, in particular, be clearly informed of how their data is processed and how they can exercise their rights.

The information notice is available on the Mimco AM website.

2.6.3. Consent of data subjects

Mimco AM is required to obtain the consent of data subjects, where applicable, before collecting, using, or otherwise processing personal data.

The Data Protection Officer implements a process to obtain and document the consent of data subjects when required.

The process regarding data subject consent ensures the traceability of information flows as well as the validity and scope of the consent obtained, and allows data subjects to easily withdraw their consent at any time.

2.7. Use of personal data

2.7.1. Processing of personal data

Mimco AM respects the interests and needs of data subjects when processing their personal data and avoids any behavior that would be contrary to their interests.

We use personal data for the following purposes:

  • Ensuring the proper functioning of Mimco AM (including the management of employment contracts);
  • Providing products and services to clients;
  • Managing relationships with clients and other counterparties (contract management, complaints, etc.); Before any new processing, or any modification to existing personal data processing, Mimco AM must verify whether consent must be obtained from the data subjects or if information must be provided to them. The GDPR officer must validate the processing process beforehand. When it is established that the processing is incompatible with the consent previously obtained, the processing may only take place if new consent, specific to the defined purposes, can be obtained from the data subject, in coordination with the GDPR officer.

2.7.2. Processing of special categories of personal data

There is a specific category of personal data, known as "sensitive data," which requires us to adopt additional protective measures. This is information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation.

Collecting or using this data is prohibited, except:

  • If the data subject has given their express consent (an active, explicit, and preferably written process, which must be free, specific, and informed);
  • If the information has been manifestly made public by the data subject;
  • If they are necessary to protect human life;
  • If their use is justified by public interest and authorized by the CNIL;
  • If they concern members of an association or a political, religious, philosophical, or trade union organization. Before collecting or processing such personal data, employees must contact the GDPR manager to establish a legal basis for the processing and to implement specific technical and organizational measures. The results of this analysis must be recorded and kept as proof of the application of adequate protection measures.

2.7.3. Personal data quality

High-quality personal data is essential to comply with the accuracy principle imposed by the GDPR. Mimco AM has adopted specific measures to ensure that personal data is complete and accurate at the time of collection and remains up to date throughout its lifecycle.

To achieve a high level of data quality, employees must be aware of the following requirements:

  • Correction (including erasure and replacement) of personal data known to be incorrect, inaccurate, misleading, or outdated, even if the data subject has not requested a modification of their personal data.
  • Retention period for personal data, to be determined based on the purpose for which it was collected or in accordance with applicable legal retention periods;
  • Deletion of any personal data if the processing violates any of the protection principles or if the personal data is no longer necessary.
  • Erasure of personal data. When erasure is prohibited by law or would infringe upon the interests of the data subject, the data will be restricted. Mimco AM expects its employees to contribute to the implementation of these measures and to inform the GDPR manager if they become aware of events that would require the implementation of corrective measures.

2.8. Data retention

A retention period must be defined for all personal data. It must be consistent and justified in relation to the purpose of the processing. In principle, personal data must be erased after its current use, i.e., the time necessary for the purpose of the processing. The retention periods applicable to the different categories of data as well as the appropriate procedures for their deletion are detailed in the information security policy. At the end of the retention period, and once it is established that the data no longer needs to be kept, personal data must either be deleted, irreversibly anonymized (in the case of electronic format), or destroyed (in the case of paper records).

2.9. Data protection

Mimco AM guarantees the integrity and confidentiality of personal data by implementing appropriate security measures, ensuring in particular the implementation of protection measures

against unauthorized or unlawful processing, against loss, destruction, alteration, and any risk to which personal data could be exposed due to human error or events (natural disasters, electronic failures, etc.).

Personal data security measures are detailed in the information security policy. Employees must be aware of their rights and obligations regarding data security and specifically commit to:

  • Secure the electronic transmission of personal data by preventing the risks of unauthorized consultation, reading, copying, modification, or deletion of personal data, and/or accidental destruction or loss. Securing personal data also involves maintaining logs to track deletions, modifications, and any other behavior that could pose a risk to the integrity and confidentiality of personal data;
  • Do not access systems where personal data is stored or processed without authorization or clearance;
  • Prevent any unauthorized person from accessing systems or premises containing personal data, and if necessary, immediately inform the Compliance Officer (RCCI) or the GDPR manager of any (potential) intrusion;
  • Consult the legal department before any contracting or contract negotiation. Contractual provisions regarding personal data must be included;
  • When processing is carried out by a third party, it must be done in accordance with the instructions provided by Mimco AM.

3. Data Protection Impact Assessment (DPIA)

Before launching any new service or product involving the processing of personal data, the Compliance team must first conduct a preliminary Data Protection Impact Assessment (DPIA). This initial assessment determines whether a full DPIA is necessary.

The CNIL publishes a list of processing activities exempt from the DPIA requirement. For these activities, Mimco AM relies on this exemption and does not conduct a DPIA. Conversely, the supervisory authority also identifies certain processing activities for which a DPIA is mandatory. In these cases, Mimco AM proceeds directly to conducting a full DPIA.

For all other processing activities not explicitly listed, Mimco AM conducts a preliminary analysis to assess the need to carry out a full DPIA.

4. Exercise of data subject rights

Under the GDPR, any data subject may exercise rights regarding their personal data processed by Mimco AM, i.e.:

  • Their right to information;
  • Their right of access to personal data;
  • Their right to rectification of personal data;
  • Their right to the erasure of personal data;
  • Their right to the delisting of a link;
  • Their right to restrict the processing of personal data;
  • Their right to personal data portability;
  • Their right to object to the processing of personal data;
  • Their right to determine the fate of their personal data after their death. The rights of data subjects are detailed in the appendix. Data subjects may request to exercise their rights by any means. Requests from data subjects must be kept in electronic format. When a data subject makes a request by phone, in person, in writing, or by other means, it must be forwarded to the GDPR Manager, who will contact the data subject to document the request. The GDPR Manager's email address must be accessible to anyone wishing to obtain information about personal data processing or to exercise their rights. Depending on the request, the data subject may be required to provide additional information. Consequently, any employee who receives a request regarding the exercise of personal data rights must immediately forward it to the GDPR Manager. The GDPR Manager must:
  • Send an acknowledgment of receipt within 48 hours of receiving the request;
  • Log each request upon receipt and request proof of identity from the person making the request. The requester must be the data subject themselves or a person with legitimate authorization to act on behalf of the data subject.
  • Process the request diligently within 30 days of receipt from the individual.
  • Provide a response within 30 days of receiving the data subject's request, unless an exception applies; the management company guarantees that no administrative fees will be charged to the data subject or the authorized requester for reasonable requests, in accordance with GDPR principles. The process for handling GDPR requests is detailed in the GDPR request handling procedure.

5. Requests and communications to authorities

In certain circumstances, Mimco AM may be required to share personal data with authorities, without the knowledge or consent of the data subject, in the following cases:

  • Preventing or detecting a crime or offense;
  • The arrest or prosecution of offenders;
  • The assessment or collection of a tax or duty;
  • By court order or under any rule of law. If Mimco AM receives a request from a court or authority regarding a data subject for the purpose of accessing their personal data, the GDPR Officer must be informed immediately so that they can handle the request.

6. Personal data transfers outside the EU

Mimco AM may only transfer personal data that is being processed, or is intended to be processed, to a country outside the European Union if adequate measures are in place:

  • Verify adequacy decisions or the implementation of standard contractual clauses with the recipient.
  • Transfer to the recipient only the personal data strictly necessary for the specific purpose of the transfer
  • Apply appropriate security measures during the transfer, if necessary

Personnel must not transfer personal data to third parties or grant them access unless previously approved by the Data Protection Officer, to ensure that the information will be processed lawfully and appropriately protected by the recipient. Therefore, the GDPR Officer must be consulted on any proposal to transfer personal data when the data subject has not yet expressly consented to the transfer.

Employees must also be aware that processors, as defined by the GDPR, are required to report any breach or incident involving personal data transmitted by Mimco AM. For any outsourcing of services to a third party (including cloud service providers), the GDPR Officer must determine whether the processing will involve transfers of personal data to third countries and include appropriate provisions in the outsourcing agreement where necessary. The GDPR Officer will conduct regular audits of personal data processing performed by third parties, including the technical and organizational measures in place. Any major anomalies identified must be reported to management, and remediation actions must be taken.

7. Reporting a personal data breach

Any employee who suspects a personal data breach must immediately notify the GDPR Officer at: contact@makers-fund.com.

The GDPR Officer must conduct an investigation to assess the level of risk associated with the personal data breach. If the incident poses a risk to the privacy of the affected individuals, you must notify

In the event of a confirmed risk, it is mandatory to notify the CNIL within 72 hours of becoming aware of the breach; in the event of a high risk, it is mandatory to notify both the CNIL and the affected individuals within 72 hours of becoming aware of the breach.

The process is detailed in the incident management procedure. Any personal data breach must be recorded in the incident register.

8. Training

An annual training plan must be developed by the GDPR Officer to offer awareness sessions or training based on employees' risk exposure. Every employee must complete at least one awareness/training session within one month of starting their role (initial training), and then once per year (ongoing training). A training register must be kept up to date, and attendance sheets must be retained.

The GDPR Officer must regularly communicate the rules and processes in effect.

9. Consequences of non-compliance with the policy

Failure to comply with this policy could have serious repercussions on Mimco AM's reputation. If it is found that the company has breached applicable laws and regulations, Mimco AM may be fined up to 4% of its total worldwide annual turnover or 20 million euros, whichever is higher.

In the event of a violation of this policy by an employee, the latter may be subject to sanctions (disciplinary measures up to and including dismissal, as well as criminal and civil penalties).

10. Appendices

Appendix 1: DATA PROTECTION FRAMEWORK – PLAN-DO-CHECK-ACT (PDCA)

Appendix 2: Information notices

The information notice to be provided to the data subject must include the following elements:

  • Identity and contact details of the personal data controller;
  • The Data Protection Officer (where applicable) and their contact details;
  • The purpose(s) of the processing activities as well as the legal basis for the processing;
  • The recipient or categories of recipients of the personal data (where applicable);
  • The fact that the data controller intends to transfer personal data to a third country or an international organization, and the existence or absence of an adequacy decision by the Commission or a reference to appropriate or suitable safeguards;
  • The retention periods for personal data and the criteria used to determine this duration;
  • Where processing is based on consent, the existence of the right for the data subject to withdraw their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
  • The existence of certain rights for data subjects: the right of access, rectification, erasure, restriction of processing, objection to processing, and data portability;
  • The right to lodge a complaint with a competent authority;
  • The existence of a legal or contractual obligation to provide personal data, or an obligation necessary for the conclusion of a contract, as well as the data subject's obligation to provide the personal data and the possible consequences of failure to provide such data;
  • The existence of automated decision-making (where applicable), including profiling, as well as the significance and envisaged consequences of such processing for the data subject; and
  • If personal data is collected from persons other than the data subject, indicate the source of the data and, where applicable, whether it originates from publicly accessible sources.

Appendix 3: Legal bases for processing

To be implemented, any processing of personal data must be based on a legal basis provided for by the GDPR, which is what gives the data controller the right to process personal data.

There are 6 legal bases (Art. 6 of the GDPR):

  • Consent. The data subject must consent to the processing of their personal data.
  • Contract. Personal data processing is necessary for the performance or preparation of a contract with the data subject.
  • Legitimate interest. Processing is necessary for the pursuit of legitimate interests (e.g., commercial, security, property, etc.) of the data controller or a third party, while respecting the rights and interests of the data subjects. The data controller must therefore balance their interest against the interests of the individual (including the individual's reasonable expectations). This balancing test must be performed for each processing activity based on this legal ground.
  • Legal obligation. Processing is required by law.
  • Public interest task. Processing is necessary for the performance of a task carried out in the public interest.
  • Protection of vital interests. Processing is necessary to protect the vital interests of the data subject or another person.

Appendix 4: Consent

The Act of January 6, 1978 (French Data Protection Act) makes the lawfulness of personal data processing subject to one of the six conditions it lists (Art. 5). The primary condition relates to the consent of the data subject. The conditions for lawful processing are formulated in terms similar to those used in the European regulation (GDPR Art. 6, 1).

Thus, consent is the primary condition for the lawfulness of personal data processing. Its main characteristics are as follows:

  • Consent must be a freely given, specific, informed, and unambiguous indication of wishes: the data subject must accept the processing through a clear statement or positive action.
  • Consent must be given for one or more clearly defined purposes.
  • Consent can only be considered "freely given" if the data subject is able to refuse or withdraw their consent without suffering pressure or detriment;
  • Consent is only "specific" if it responds to a sufficiently detailed request, allowing the data subject to provide separate consent for each processing purpose;
  • Consent is only "informed" if the data subject receives certain essential information: for example, the identity of the data controller, the purpose of each processing operation, and the data collected and used;
  • Consent is only "unambiguous" if it results from a statement or a "positive action" by the data subject. As the data controller, Mimco AM must be able to demonstrate that consent was effectively given in a clear and simple manner. The data subject must have the option to withdraw their consent at any time.

Appendix 5: Cookies and other trackers

Cookies are small files stored by a server on a user's device (computer, phone, etc.) and associated with a website. Cookies and other trackers have various uses (website management, statistical or advertising analysis, etc.).

Anyone visiting the Mimco AM website must be able to manage cookies and other trackers at any time. Mandatory notices must be included on the website in a clear and easily accessible manner. In principle, all types of cookies and trackers, with the exception of strictly necessary cookies (required for the site/portal to function), require the prior and informed consent of the data subject.

Appendix 6: Data subject rights

Data subjects may exercise rights regarding their personal data and may request, depending on the legal basis and the circumstances of the processing, one of the following:

  • A right of access: this allows you to know if your personal data is being processed and to obtain a copy of it in an understandable format. It also allows you to check the accuracy of the data and, if necessary, to have it rectified or erased.
  • A right to rectification: to have information concerning them rectified, completed, updated, blocked, or erased when errors, inaccuracies, or data whose collection, use, communication, or storage is prohibited have been identified.
  • A right to erasure, also known as the right to be forgotten, to obtain the erasure of personal data concerning them as soon as possible;
  • A right to restriction of processing: to obtain the restriction of processing so that, with the exception of storage, the data may only be processed by Mimco AM with the data subject's consent or for the establishment, exercise, or defense of legal claims;
  • A right to data portability (to receive the personal data concerning them in a structured, commonly used, and machine-readable format, and the right to transmit those data to another controller);
  • A right to object (to object to the processing of personal data concerning them, under certain conditions); and
  • A right to object to automated decision-making and profiling (this is the data subject's right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them). Data subjects have the right to obtain, upon written request and after verification of their identity by the GDPR controller, the following information regarding their own personal data (subject to exceptions):
  • The purposes of the collection, processing, use, and storage of their personal data;
  • The source(s) of the personal data, if they were not obtained from the data subject;
  • The categories of personal data stored for the data subject;
  • The recipients or categories of recipients to whom the personal data have been or may be disclosed, as well as the location of these recipients;
  • The intended retention period for the personal data or the reason why the retention period was determined;
  • Recourse to any automated decision-making, including profiling; and
  • The data subject's right to:
    • Object to the processing of their personal data.
    • File a complaint with the data protection authority.
    • Request the rectification or erasure of their personal data.
    • Request the restriction of the processing of their personal data.

‍