Employee Privacy Notice

Some of the information FundBank collects may fall within the category of sensitive personal data — for example, background checks may reveal information about criminal convictions or offences, and we may also need to collect health status information. Where FundBank processes sensitive personal data, it will usually do so to comply with its obligations under anti-money laundering legislation (including the obligation to screen relevant employees) or to perform its obligations under your employment contract. In all cases, the processing of sensitive personal data will comply with the additional lawful basis requirements under the DPA.

We collect personal data from you or third-party sources such as previous employers and specialist screening databases. If we ask you for information that we need, to comply with our legal obligations or to perform our contractual obligations to you and you do not provide it, you may lose benefits, or we may decide not to employ you or to end your contract.

Purposes for Which FundBank Processes Personal Data

Set out below are the purposes for which FundBank Bank may process personal data in the context of our workplace relationships and the lawful basis for doing so:

• General business purposes including management and administration of FundBank as a regulated entity and a Cayman Islands company and compliance with attendant legal and regulatory obligations
• Recruitment
• Managing and administering employment contracts (including termination)
• Payroll and benefits administration.
• Financial planning and budgeting
• Performance management, staff development, and support
• Dealing with misconduct, disciplinary, and grievance issues
• Workplace safety and security (premises and systems)
• Establishment, exercise, or defence of legal claims or rights

FundBank will only process personal data where we have a lawful basis for doing so under the DPA. The lawful bases we primarily rely upon are:

• that it is necessary for the performance of a contract to which the data subject is a party
• that it is necessary to comply with our legal obligations (as a regulated entity, an employer, and a Cayman Islands company)
• that it is necessary for our legitimate interests
• that it is necessary for the purposes connected with the data subject’s employment or to the exercise of a function in the public interest conferred under law (in the case of the processing of sensitive personal data of workplace data subjects)

We would rely on consent in limited circumstances, e.g., we would need your authorization/consent to provide a reference to a prospective new employer.

Our legitimate interests will include operating our business in a commercially optimal and sound manner; managing a high-quality workplace and workforce; compliance with regulatory measures to which we are subject concerning, for example, IT/data security and business continuity/disaster recovery; establishing, exercising or defending legal claims or rights or dealing with complaints or disputes that may arise; conducting merger, sale or acquisition activity. When FundBank processes personal data to meet its legitimate interests, we ensure that those interests are balanced against the interests or fundamental rights and freedoms of data subjects.

How FundBank May Share Personal Data

Personal data may be shared with or disclosed to various recipients external to FundBank, including:

• insurers and other benefit providers
• The Cayman Islands regulatory, law enforcement, judicial or other competent authorities under lawful request or legal obligation
• Cayman Islands government labor/employment, immigration, and pension authorities
• our lawyers and other professional advisors and our auditors
• providers of ‘due diligence’ screening services
• any concerned party as a result of a merger or the sale or acquisition of FundBank or a FundBank service line

In addition, FundBank outsources to a cloud-based IT services provider involved in our processing of personal data. Where we engage a third party to process personal data on our behalf, we ensure that there is a written agreement in place with contractual terms that provide for appropriate data protection and confidentiality. Similarly, if we transfer personal data outside of the Cayman Islands in connection with our IT services outsourcing, we will ensure that DPA provisions are observed concerning any such transfers so that an adequate and appropriate level of data protection is achieved.

How Long FundBank Keeps Personal Data

FundBank will retain personal data on workplace data subjects for the duration of your relationship with FundBank and such period after the relationship ends as may be necessary to enable FundBank to be in a position to deal with any complaint, claim or dispute that might arise. Personal data relating to unsuccessful job applicants will typically not be retained for longer than six months unless you consent to an extended period.

Security

FundBank deploys reasonable and appropriate technical and organizational measures to ensure that personal data is properly protected against unauthorized or unlawful processing and against accidental loss, destruction, or damage. Our measures include ensuring that any data processor we use to process personal data on our behalf is contractually required to keep that personal data equally confidential and secure.

Data Subject Rights

In addition to the right to be informed, to which this privacy notice responds, data subjects have the following rights, which may be restricted in certain circumstances as provided under the DPA:

• the right to access your personal data
• the right to rectification
• the right to stop or restrict processing
• the right to stop direct marketing
• rights concerning automated decision-making
• the right to file a complaint with the Ombudsman if you consider that your personal data has not been processed in compliance with the DPA
• the right to seek compensation for damage suffered as a result of a contravention of the DPA by a data controller

If you have any questions about this privacy notice or how to make a subject access request or exercise other
data subject rights, please contact us at compliance@fundbank.com.

How to Contact The Ombudsman
FundBank is committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If, however, you believe that FundBank has not been able to assist with your complaint or concern, you have the right to make a complaint to the Cayman Islands Ombudsman, who is the data protection authority. The Ombudsman may be contacted at:

Visit: 5th Floor, Anderson Square, 64 Shedden Road, George Town, Grand Cayman
Mail: PO Box 2252, Grand Cayman KY1-1107, CAYMAN ISLANDS
Email: info@ombudsman.ky
Call: +1 345 946 6283

The Ombudsman provides a complaint form that may be accessed from www.ombudsman.ky/data-protection

Status of This Privacy Notice

This privacy notice does not form part of your contract of engagement, and it does not create contractual rights or obligations. Nothing in this notice is intended to create an employment relationship between FundBank and any person engaged by us on a ‘contract for services’ basis.

We reserve the right to amend this privacy notice from time to time at our sole discretion. If we make any material changes, we will endeavor to notify you by appropriate means, and we will update the “Last Updated” date at the bottom. A copy of the latest version may be requested from compliance@fundbank.com at any time.