Candidate Privacy Notice

Introduction

JJJ Capital Management LLP, JJJ Capital Management (DIFC) Limited and JJJ Capital Management (Jersey) Limited (together "JJJ Capital", "we", "us", "our") are committed to being transparent about how we collect and use your personal data and to meeting our obligations under data protection laws, including the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, the Dubai International Financial Centre Data Protection Law, DIFC Law No. 5 of 2020 (the "DIFC DPL") and the Data Protection (Jersey) Law 2018 (the "Jersey DPL"), as applicable.

The purpose of this Privacy Notice is to inform all candidates, applicants and prospective staff about our collection and use of their personal data and about their rights under data protection laws. Any references to "employees" or "employment" in this Privacy Notice also encompass other forms of prospective staff engagement, where applicable.

Please take time to read this Privacy Notice carefully. It is important that you fully understand how we are processing your personal data and how we are protecting your privacy.

Date of issue: September 2026
Updated: October 2026

1. Who is the Data Controller?

The controller of your personal data will generally be the JJJ Capital entity considering your application or candidacy. This will either be: JJJ Capital Management LLP, 5th Floor, Greycoat Stores, 10 Greycoat Place, London, SW1P 1SB, United Kingdom (Company number: OC445465); JJJ Capital Management (DIFC) Limited, Index Tower, Level 4, Unit 406, DIFC, Dubai; or JJJ Capital Management (Jersey) Limited, Aztec Group House, IFC6, The Esplanade, St. Helier JE4 0QH, Jersey.

2. What Information is Included in this Privacy Notice?

This Privacy Notice is designed to provide you with information about:

• the types of personal data we process;
• the purposes and legal bases for any processing;
• who we may share your personal data with;
• when we may transfer your personal data internationally;
• the period for which any personal data will be stored; and
• the rights you have in relation to your personal data.

3. What Personal Data Do We Process About You?

We process the following categories of personal data about you:

• personal details such as name, gender, date of birth, nationality and contact details (such as address, phone numbers and email addresses);
• application and role information such as the role applied for, job title, business area, location, salary expectations and/or proposed remuneration, preferred working arrangements, availability, notice period, proposed start date, contract type and duration (where applicable) and application status;
• recruitment and professional information such as application forms, CVs, cover letters, employment history, work experience, qualifications, professional skills, academic and training information, interview notes, candidate assessments, references, information provided by previous employers, records/results of pre-employment checks (including criminal record checks and credit checks, where applicable), and other information provided during the recruitment process;
• identification information such as photographs, passport, Emirates ID (in the DIFC), registration card (in Jersey), driving licence, birth certificate and proof of address;
• screening and financial information such as National Insurance numbers, social security numbers, tax details and financial checks (where applicable);
• right to work documentation which may include birth certificate, passport/driving licence, registration card (in Jersey), details of visa, residency or work permit, immigration status, residential and employment status (in Jersey), expatriate status, government identification numbers and any necessary professional consents or licences (to demonstrate the right to work in the UK, DIFC, Jersey or abroad where required for business purposes);
• information relating to our premises and/or use of our IT and other communication systems such as information generated through candidate portals, application platforms, recruitment tools, email correspondence, video interview platforms, IP addresses, device information and visitor access records; and
• monitoring information such as CCTV footage or visitor swipe card records and technical information relating to your use of our systems.

We also process the following sensitive or "special category" personal data about applicants and candidates, where permitted under applicable laws, such as:

• information about health and disabilities (where applicable), including reasonable adjustments required during the recruitment process; and
• where it is required for your role, information about your criminal record collected pursuant to an enhanced Disclosure Barring Service (DBS) check. The enhanced DBS check will show any spent or unspent convictions, cautions, reprimands or warnings, and any other relevant information held about you by your local police force (which includes the UK police force and States of Jersey Police for requests in Jersey). Further details about the processing of such data will be provided to you at the time such data is sought.

4. How Do We Collect Your Personal Data?

Directly from you: We collect personal data from you directly (electronically, in writing, or verbally). For example, you may provide personal data to us when submitting an application, providing a CV or cover letter, attending interviews, completing assessments, corresponding with us during the recruitment process or providing information required as part of any pre-employment checks.

Generated by us: We may generate personal data about you during the recruitment process, such as interview notes, candidate assessments, records of screening activities, recruitment correspondence and information relating to hiring decisions. Personal data may also be generated through the use of AI software and tools (such as those used to automatically summarise or transcribe interviews or meetings).

From third parties: We may also receive personal data relating to you from third parties. These may include service providers (such as companies that carry out DBS checks on our behalf or provide occupational health services), recruitment agencies, referees, previous employers, academic institutions, certification bodies, government agencies, regulators, and publicly available sources.

5. How Do We Use Your Personal Data?

We generally use your personal data to allow us to assess your suitability for employment or engagement with us, to manage our recruitment processes and to comply with our legal and regulatory obligations. In particular, we use your personal data:

• to process and assess your application and determine your suitability for a role with JJJ Capital;
• to communicate with you regarding your application and the recruitment process, and arrange and conduct interviews, assessments and other recruitment activities;
• to make hiring decisions, prepare offers of employment or engagement and take steps prior to entering into an employment or engagement relationship with you;
• to verify information provided by you, including your qualifications, experience and professional credentials, and to obtain references and conduct background screening, credit checks, criminal record checks and other pre-employment checks where permitted by applicable law;
• to assess any reasonable adjustment requirements and facilitate an accessible recruitment process;
• to verify your identity and your right to work in the UK, DIFC, Jersey or any other relevant jurisdiction;
• to maintain records relating to the recruitment process and, where appropriate, to consider you for future opportunities;
• for business management and workforce planning purposes and to operate our business effectively;
• to manage and safeguard our recruitment systems, IT infrastructure and communications systems, and to ensure network and information security;
• for security and health and safety purposes, including maintaining the security of our premises and systems;
• to monitor compliance with applicable laws, regulations and internal policies and procedures;
• for legal and regulatory purposes, including complying with applicable employment, immigration, regulatory, tax, social security and accounting obligations;
• for establishing, exercising or defending legal claims; and
• for the prevention and detection of unlawful acts, including fraud.

Your personal data will not be used for direct marketing purposes.

6. Why Do We Process Your Personal Data?

We only process personal data about candidates and applicants where the processing can be legally justified. We will usually rely on one of the following lawful bases for the processing:

• to take steps at your request prior to entering into an employment or engagement contract, including assessing your application, managing the recruitment process, communicating with you regarding your application and preparing offers of employment or engagement.
• for ensuring compliance with our legal obligations: for example, to allow us to check that you have the right to work in the UK, DIFC or Jersey;
• for our legitimate interests (or those of a third party), provided your interests and fundamental rights do not override those interests, for example:
  • to recruit and select suitably qualified candidates for roles within JJJ Capital;
  • to assess applications and determine candidates' suitability for available roles;
  • to operate, administer and improve our recruitment processes and hiring procedures;
  • to maintain records relating to recruitment activities and recruitment decisions;
  • to protect and enforce our legal rights and interests, including in connection with actual or potential legal claims;
  • to operate our business efficiently and effectively;
  • to maintain the security of our premises, systems and information;
  • to maintain compliance with our internal policies and procedures; and
  • to prevent fraud and other unlawful activities.
• with your consent, in limited circumstances and where permitted by law. Further details about the processing of such data will be provided to you at the time such consent is sought. In such circumstances you can withdraw your consent at any time, although please note that a revocation of consent would not affect the lawfulness of any processing that has already occurred.

In the case of special categories of personal data (such as information about your health, sick leave, religious beliefs, sex life or sexuality and race/ethnicity data) and criminal records data, extra protections apply under data protection legislation. We therefore usually only process special category personal data and criminal records data in the following circumstances and where permitted by applicable laws:

• where it is necessary for the purposes of performing or exercising obligations or rights under employment law;
• where it is necessary in order to establish, exercise or defend legal claims (or potential legal claims);
• where it is necessary for the purposes of equal opportunities monitoring;
• where it is necessary for reasons of public interest in the area of public health;
• where it is necessary for reasons of substantial public interest, including to prevent fraud and unlawful acts; and/or
• where we have your explicit consent.

7. Do We Use Automated Decision-Making?

We do not envisage that any decisions will be taken about you using solely automated means. We will notify you if this changes.

8. With Whom Might We Share Your Personal Data?

We may share your personal data with third parties, such as:

• other companies and affiliates within the JJJ Capital group;
• third party service providers, which may include recruitment agencies, background screening providers, reference checking providers, applicant tracking system providers, suppliers of our IT infrastructure and other technical services, or enterprise AI tools; service providers in relation to recruitment, learning and development, HR and occupational health services; companies that provide marketing or other advertising related services; and software providers who provide us with audio-visual communication tools;
• government bodies, dispute resolution and law enforcement organisations and other regulators, including the DIFC, FCA, JFSC, HMRC, Revenue Jersey, law enforcement agencies and the courts;
• our advisors, including accountants, auditors, lawyers and other external professional advisors;
• any third party as directed by you; and
• other third parties in the context of a sale of our business or its assets or a restructuring exercise.

9. Is Your Personal Data Transferred Internationally?

We may transfer your personal data outside the DIFC, the UK or Jersey (as applicable) from time to time, for the purposes outlined in this Privacy Notice. For example, personal data may be transferred to, or accessed by, third-party service providers located in the United States. This means that personal data may be transferred to jurisdictions that do not offer an equivalent level of legal protection as the DIFC, the UK or Jersey.

When we transfer personal data internationally, we take appropriate steps to ensure that it remains protected in accordance with applicable data protection laws, for example:

• the transfer is to a country that has been recognised by the DIFC Commissioner of Data Protection or the UK Government or the European Commission (as applicable) as providing an adequate level of protection;
• we have put in place contractual terms approved by the DIFC Commissioner of Data Protection or the UK Government or the Jersey DPL (as applicable) to ensure that your personal data is safeguarded appropriately; or
• the recipient has certified to an approved certification mechanism, such as the US Data Privacy Framework scheme, in respect of which the UK has put in place the UK-US Data Bridge.

We may also rely on other lawful transfer mechanisms permitted under applicable data protection laws. In all cases, personal data will only be transferred where appropriate safeguards are in place.

If you would like further information about the safeguards we use in connection with international transfers, including copies of the relevant transfer mechanisms (where available), please contact us using the details set out at the end of this Privacy Notice.

10. How Long Do We Keep Hold of Your Personal Data?

We only retain personal data for as long as is reasonably necessary to fulfil the purposes identified above, as required by law, or to establish, exercise or defend potential legal claims. The period for which we retain personal data will depend on factors such as the nature of the information, the purposes for which it was collected and any applicable legal or regulatory retention requirements.

11. What Are Your Legal Rights?

You may have certain rights under applicable data protection law (subject to certain conditions), including:

• to obtain access to your personal data and request information about how we process it;
• to request the correction or completion of your personal data if it is inaccurate, incomplete or out of date;
• to ask us to erase or destroy your personal data held by us in certain circumstances (please note that there may be circumstances where you ask us to erase your personal data, but we are legally entitled to retain it);
• to object to, or ask us to restrict, our processing of your personal data in certain circumstances (please note that there may be circumstances where you object to, or request the restriction of, our processing of your personal data, but we are legally entitled to continue processing it);
• to ask us to transmit personal data you have provided to us back to you or to another organisation in certain circumstances;
• under the DIFC DPL: not to be discriminated against for exercising any of your rights under the DIFC DPL;
• under UK GDPR: to lodge a complaint with us in relation to our processing of your personal data; and
• where we are relying on your consent, to withdraw your consent at any time.

Please contact us using the contact details in Section 14 if you wish to exercise any of the above rights.

If you have a complaint about how your personal data is processed or whether your rights have been exercised correctly under this Privacy Notice, you have the right to complain to the relevant supervisory authority, the contact details for which can be found at Section 15.

12. Use of AI Tools - Your Rights Under the DIFC DPL

Please read this section carefully. It applies to personal data processed subject to the DIFC DPL. It does not apply where the UK GDPR or the Jersey DPL apply.

We use AI tools in some instances to process personal data subject to the DIFC DPL. When we do process your personal data using such tools, in some cases, due to the technical nature of how the particular tool operates, the personal data that is processed by the applicable tool is not strictly kept as a separate record that we can simply find, change or delete. Instead, it may be absorbed into the datasets used by the underlying AI model, and may also persist in copies such as back-ups or logs, including those held by the applicable third party providers we use. As a result, once your personal data has been processed in this way, it may not always be technically feasible for us to correct or erase it, or to give effect to an objection. This is an inherent limitation of certain AI systems.

Where it is technically feasible for us to access your personal data used in respect of such AI tools, your right to correct or erase it, or object to such processing should not be affected in the same way.

13. Your Responsibilities

It is important that the personal data we hold about you is accurate and up-to-date. If your personal data changes it is important for the protection of your own interests that you let us know promptly.

If you fail to provide certain information to us when requested, we may not be able to process your application, assess your suitability for a role, carry out required pre-employment checks or comply with our legal obligations and we may be unable to continue with the recruitment process.

14. Contacts & Changes

If you have any questions about this Privacy Notice or the personal data we hold about you, please contact us:

• by email at: [email protected].
• by post to: Human Resources, JJJ Capital Management LLP, 5th Floor, Greycoat Stores, 10 Greycoat Place, London, SW1P 1SB, United Kingdom; JJJ Capital Management (DIFC) Limited, Index Tower, Level 4, Unit 406, DIFC, Dubai; or JJJ Capital Management (Jersey) Limited, Aztec Group House, IFC6, The Esplanade, St. Helier JE4 0QH, Jersey.

We may update this Privacy Notice periodically. Where we make any material changes, we will inform you of those changes. This notice is non-contractual, which means it does not confer any legal rights on any applicant or candidate and we may amend it at any time in line with law or good practice.

15. Complaints

We strive to process your personal data in accordance with applicable data protection law. If you have any concerns or complaints about how we process your personal data, please contact us at [email protected] or by using the details in section 14 above.

You also have the right to lodge a complaint with a supervisory body for data protection if you are not happy with how we handle your personal data. The DIFC Commissioner's Office is the supervisory body in the DIFC and may be contacted at Dubai International Financial Centre Authority, Level 14, The Gate Building, +971 4 362 2222, [email protected]. In the UK, the Information Commission is the supervisory body, and its contact details are available at www.ico.org.uk. In Jersey, the Jersey Office of the Information Commissioner is the supervisory body, and its contact details are available at jerseyoic.org.