ExodusPoint Global Privacy Notice

Effective April 3, 2023

This Global Privacy Notice describes the policies and procedures followed by ExodusPoint Capital Management, LP and its affiliates (together, “ExodusPoint”, “we”, “our”, or “us”) regarding the collection, use, and disclosure of your personal information when you visit our website or otherwise interact with ExodusPoint. For the purposes of European, Dubai International Financial Centre (“DIFC”), and UK data protection laws, ExodusPoint is the data controller of your personal information. Please note that when using the website, this Global Privacy Notice should be read in conjunction with our Terms of Use and is incorporated into our Terms of Use.

If you are an individual investor in the United States, your privacy rights are described in our GLBA Notice.

Collection of Personal Information. When you visit the website, receive services from us or otherwise interact with ExodusPoint, we may collect and process the following data about you:

• Information that you give to us – you may give us personal information including your name, company name and contact details, including address(es), telephone number(s) and email address. If you are an investor, we may also collect your passport information, social security number, information about your assets, account balances, transaction history, investment experience, and wire transfer instructions. You are not under any obligation to provide any of this information. However, if you withhold requested information, we may not be able to provide certain services to you.
• Information that we collect about you – we may automatically collect basic technical information from all visitors to the website through our automatic data collection tools, which may include cookies and other commonly used technologies (see section on Cookies below). These tools collect certain standard information that your browser sends to the website, such as your browser type and language, access times and the address of the site from which you came to the website. They may also collect your Internet Protocol address or click stream data within our website (i.e. the actions taken in connection with the website). This information helps us improve the functionality of the website.
• Information that we receive from other sources – we may collect personal information from different sources, including social media, analytics providers, and search information providers, including search engines and other public sources.
• Information may also be collected about you indirectly from monitoring or other means (e.g. recording of telephone calls and monitoring e-mails to us). In these circumstances, the information is not accessed on a continuous or routine basis, but it may be used only for legal, compliance, or security purposes.

Use of your Personal Information. We may use the personal information you give us to carry out the following purposes:

Purpose	Lawful Basis
To contact you and to respond to your requests, inquiries and other communications	We have a legitimate interest in responding to your requests and inquiries for ongoing business administration
To deliver services to you	To manage and perform our contract with you
For employment recruitment purposes	We have a legitimate interest in considering an applicant for a role or vacancy in accordance with our employment recruitment process and contractual obligations and/or to take pre-contractual steps (such as background screening, vetting or reference checks)
For business administration, including statistical analysis	We have a legitimate interest in the proper management and administration of our relationship with you and to ensure that we are as effective and efficient as we can be
To personalize your visit to the website and to assist you while you use the website	We have a legitimate interest in the proper management and administration of our relationship with you and to ensure that we are as effective and efficient as we can be
To improve the website by helping us understand who uses the website	We have a legitimate interest in the proper management and administration of our relationship with you and to ensure that we are as effective and efficient as we can be
In connection with corporate sales or other restructuring events	We have a legitimate interest in the processing of your data in connection with the sale or reorganization of all or part of our business or its assets
For fraud prevention and detection and to comply with applicable laws, regulations, or codes of practice including complying with any obligations derived from anti-money laundering and counter-terrorism legislation	To comply with our legal obligations and our legitimate interests

You have a right to object to the processing of your personal information where that processing is carried out for our legitimate interest. An objection will be deemed justified unless compelling grounds for such processing override your interests as a Data Subject. As such, the right to object is not absolute.

Sharing your Personal Information. We may use selected third parties to provide us with services or technical support for the website who may have access to your personal information.

• If you are an investor, we may also disclose certain personal information to our affiliates and service providers, such as fund administrators (including, but not limited to, Northern Trust Global Fund Services Cayman Limited and its affiliates), custodians, broker-dealers, accountants, and lawyers, as necessary to effect and administer the fund and enforce our rights and obligations. All service providers, including providers of software as a service, are permitted to use data only for the purpose of performing services on our behalf.
• Similarly, we may share your personal information as required by law to protect our rights and property, or the rights, property, or safety of others, including with advisers, law enforcement agencies, and judicial and regulatory authorities.
• Subject to applicable laws, we may also share your personal information with our affiliates for their marketing purposes. If you do not want us to share information with our affiliates for their marketing purposes, please contact us using the information below.
• We may transfer or share a copy of personal information about you in the event that we or one of our assets, affiliates or subsidiaries goes through a business transition, such as a merger, being acquired by another company, being reorganized or liquidated or the sale of a portion of our or their assets. Nothing in this Privacy Notice is intended to interfere with our ability to transfer all or part of our or one of our asset’s, affiliate’s or subsidiary’s business and/or assets to an affiliate or independent third-party at any time, for any purpose, without any limitation whatsoever. We specifically reserve the right to transfer or share a copy of personally identifiable information collected from our or their websites to the buyer of that portion of our or their business relating to that information during any diligence process.

Rights of Individuals in Europe and the United Kingdom (and certain other jurisdictions). As a Data Subject, you have certain data privacy rights that may be subject to limitations and/or restrictions. These rights include the right to: (i) request access to and rectification and erasure of your personal information; (ii) obtain restriction of processing or to object to processing of your personal information; and (iii) ask for a copy of your personal information be provided to you, or a third-party in a digital format. You also have the right to lodge a complaint about the processing of your personal information with your local data protection authority. Such rights are subject to applicable exemptions and restrictions under applicable laws. For questions and to submit a rights request, please contact us as described below under “Contact Us”.

• Individuals in Andorra, Argentina, Australia, Canada, Faroe Islands, Guernsey, Hong Kong, Isle of Man, Israel, Jersey, Mexico, New Zealand, South Korea, Switzerland, Uruguay, and certain other jurisdictions may also exercise these or similar rights.

California Privacy Rights. Under California law California residents are entitled to ask us for a notice describing which categories of personal customer information we share with third parties or corporate affiliates for those third parties or corporate affiliates’ direct marketing purposes. That notice will identify the categories of information shared and will include a list of the third parties and affiliates with which it was shared, along with their names and addresses. If you are a California resident and would like a copy of this notice, please submit a request to us via privacy@exoduspoint.com. Please allow thirty (30) days for a response.

To the extent applicable, California law also provides California residents with the following rights with respect to their personal information:

• The right to know the categories and specific personal information collected from you that ExodusPoint has collected, used, disclosed, and sold. To submit a request to know this information, California residents may contact us as described below under “Contact Us.” California residents may also designate an authorized agent to make a request for access on their behalf.
• The right to request that ExodusPoint correct any inaccurate personal information that it has collected. To submit a request for correction, California residents may contact us as described below under “Contact Us.” California residents may also designate an authorized agent to make a request for correction on their behalf.
• The right to request that ExodusPoint delete any personal information it has collected. To submit a request for deletion, California residents may contact us as described below under “Contact Us.” California residents may also designate an authorized agent to make a request for deletion on their behalf.
• The right to appeal any decision ExodusPoint makes regarding your California privacy rights. To submit an appeal, California residents may contact us as described below under “Contact Us.” Please clearly indicate that your request is an “Appeal.” California residents may also designate an authorized agent to make an appeal on their behalf.

When California residents exercise these rights and submit a request, ExodusPoint will verify their identity by asking them for information such as their email address, telephone number, and/or information about their account with us. We will endeavor to honor requests unless such a request conflicts with certain lawful exemptions under California law, including where necessary to comply with other legal obligations. Please note that ExodusPoint is only required to honor such requests twice in a twelve (12) month-long period.

Exercise of these rights will have no adverse effect on the price and quality of our services to you.

For the twelve (12) month period prior to the date of this Privacy Notice, we have not sold any personal information and have not shared any personal information for cross-contextual advertising; nor do we have any plans to do so in the future.

Japan Privacy Rights. When we are requested by you in accordance with procedures we have specified:

• to disclose your personal information to you, we will disclose such information to you as soon as practicable, unless such disclosure would be in violation of law; and/or
• to correct, add to, or delete your personal information on the basis that such information is inaccurate, we will review the facts relating to such request without delay and will correct, add to, or delete the information on the basis of such review, to the extent required by law.

When we are requested by you to stop using your personal information on the basis that such information was collected improperly or is being used for purposes other than those specified without your consent, we will review the facts relating to such request without delay. If we find a valid reason for such request, we will cease the use of such personal information. We will receive and respond efficiently and appropriately to any inquiries and complaints concerning our handling of personal information. Please refer to the “Contact Us” section below. All your rights are subject to applicable exemptions and restrictions under applicable laws.

Hong Kong Privacy Rights. When we are requested by you to stop using your personal information on the basis that such information was collected improperly or is being used for purposes other than those specified without your consent, we will review the facts relating to such request without delay. If we find a valid reason for such request, we will cease the use of such personal information. We will receive and respond efficiently and appropriately to any inquiries and complaints concerning our handling of personal information. Please refer to the “Contact Us” section below. All your rights are subject to applicable exemptions and restrictions under applicable laws.

Singapore Privacy Rights. When you visit the website, receive services from us or otherwise interact with ExodusPoint and voluntarily give your personal information, we will deem that you have given consent for us to collect and process such information in line with this Privacy Notice. If you wish to withdraw consent or notify us that you do not consent, please contact us using the information below. All your rights are subject to applicable exemptions and restrictions under applicable laws.

International Data Transfer—Consent.

• Europe and UK. When you are based in Europe, the DIFC and/or the UK, personal information collected from you, including via the website, will be transferred to certain recipients located outside of Europe (including in the United States where the website is hosted) and/or the DIFC that may not provide a similar or adequate level of protection compared to that provided by countries in Europe, the UK and the DIFC. You hereby consent to the transfer of your personal information to recipients as described in this Privacy Notice that are located outside of Europe, the UK and the DIFC. You may withdraw your consent at any time. With regards to any personal information transferred outside of the DIFC, any such transfer shall be in accordance with applicable law and, where appropriate, ExodusPoint shall use standard contractual clauses in the form approved by the DIFC Commissioner of Data Protection (which may be found here).
• Japan and Singapore. When you are based in Japan or Singapore, personal information collected from you, including via the website, will be transferred to certain recipients located outside of Japan or Singapore (including in the United States where the website is hosted) that may not provide a similar or adequate level of protection compared to that provided in Japan or Singapore. You hereby consent to the transfer of your personal information to recipients, including in the United States, as described in this Privacy Notice, that are located outside of Japan or Singapore. You may withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal, and, subject to applicable law, it will not preclude the future processing of personal information if within our legitimate interest. All your rights are subject to applicable exemptions and restrictions under applicable laws.

Security. ExodusPoint maintains physical, electronic, and procedural safeguards reasonably designed to protect your information against loss, misuse, damage, or modification and unauthorized access or disclosure. ExodusPoint can make no guarantee that these procedures will prevent all unauthorized access and, as a result, personal information submitted through or contained on the website may be vulnerable to unauthorized disclosure to unknown third parties.

Data Quality, Storage, and Access. While we endeavor to ensure that all information we hold about you is accurate, complete and up to date, you can help us in this regard by promptly notifying us if there are any changes to your personal information.

Retention. Notwithstanding anything herein to the contrary, ExodusPoint may retain your personal information as necessary for the provision of the services, for internal analytical purposes, or to comply with its legal obligations, resolve disputes and enforce agreements. The criteria used to determine the retention periods include: (i) how long the personal data is needed to provide the services and operate the business; (ii) the type of personal data collected; and (iii) whether we are subject to a legal, contractual or similar obligation to retain the data (e.g. mandatory data retention laws, government orders to preserve data relevant to an investigation, or data that must be retained for the purposes of litigation or disputes).

Right to Raise Concerns. In the event that you are not satisfied with our processing of your personal information, you reserve the right to raise a concern or submit a complaint with the applicable supervisory authority. If you wish to raise a concern with us directly, please contact us as described below under “Contact Us”.

Children’s Privacy. We do not collect or maintain information through our website from those whom we actually know are under the age of 18 and no part of our website is targeted to attract anyone under 18.

Cookies. The website may use “cookies” which may automatically collect certain information and data. Cookies are small pieces of data sent to your computer browser from our web server and stored on your computer’s hard drive. The data identifies you as a unique user and facilitates your ongoing access to and use of the website. Cookies may also help us diagnose problems with our server and the website. If you do not want us to use cookies when you use the website, you can adjust your internet browser settings to not accept cookies. Your web browser’s help function should tell you how to do this. The cookies currently used are listed below but may be updated from time to time:

• incap_ses_*: Session cookie for distributed denial-of -service (DDoS) protection and web application firewall protection on all our websites.
• fonts.net: Functional cookie to render the fonts used on www.exoduspoint.com.
• .ASPXFORMSAUTH: Session cookie to ensure users remain logged in as they browse the site’s pages and provide audit and security controls on our investor portal.
• ReturnUrl: Session cookie on our investor portal.
• ASP.NET_SessionId: Session cookie to maintain the state of the session while users browse the site from page to page on our investor portal.
• RequestVerificationToken_*: Required security token to prevent Cross-Site Request Forgery.
• PopupDisclaimerAgree: Cookie added when users agree to the pre-login site disclaimer banner/popup on our investor portal.
• AutomaticUserGUID: Cookie created when users check the “Remember Me” option on the login screen of our investor portal.
• AutomaticUserToken: Cookie created when users check the “Remember My Device” option on our investor portal.
• Google Analytics: Cookie to measure how users interact with website content on our investor portal.

Revisions to this Privacy Notice We may revise or supplement this Privacy Notice from time to time. If we make any substantial changes in the way we use or share your personal information, we will notify you by posting a notice on our website before the change becomes effective. We encourage you to refer to this Privacy Notice on an ongoing basis so that you understand our current privacy practices.

Contact Us. If you have any questions or comments about our Privacy Notice, or if you are located in California, Europe, Hong Kong, Japan, or Singapore and wish to exercise your rights as described above, please feel free to contact us at privacy@exoduspoint.com