Privacy Notice

This Privacy Notice sets out information about the online privacy practices of Nardello & Co. LLC and its affiliates (together, “Nardello”). Nardello is committed to protecting your privacy. This includes observing relevant legal and regulatory requirements and employing appropriate security measures to protect your personal information.

This Privacy Notice explains how we collect and use your personal information. If you have any questions, please contact us at privacyinfo@nardelloandco.com.

Who we are and what we do

Nardello is a global investigations firm that provides investigative services to corporations, financial institutions, high net worth individuals and law firms worldwide. Nardello operates through a network of affiliated entities, each of which is a separate legal entity. These entities include Nardello & Co. LLC in the United States, Nardello & Co. LLP in the United Kingdom, Nardello & Co. Asia Ltd. in Hong Kong, Nardello & Co. (UAE) LLC in Dubai, and Nardello & Co. Pte. Ltd. in Singapore. Depending on where you are located and the location from which legal or other services are provided, the data controller of your personal data processed by us under this Privacy Notice will be different.

Personal information we collect and use

For the purposes of this Notice, personal information is defined as any information that could reasonably be associated or linked, whether directly or indirectly, to an identified or identifiable individual or household.

We may collect and process the following type of personal information in the course of operating our business and providing our services, including:

• Contact information such as your telephone number, address, or email address;
• Identity data, such as name, username or similar identifier, marital status, title, date of birth, or gender;
• Financial data, such as bank account information;
• Personal data produced by us or provided to us by or on behalf of our clients in the course of providing our services to our client, which may, where applicable and necessary, include special categories of personal data;
• Job application data, which includes identification and contact information, education and employment history, skills and qualifications relevant to the position, and other data provided by you or recruiters, for the purpose of recruitment to Nardello, including includes your resume or CV and academic transcripts; or

We also may collect and process personal information for marketing purposes, including:

• When you contact us by any means, as we may keep a record of that contact;
• When you visit our offices or attend our events;
• Information you provide us relating to your preferences in receiving marketing information from us and your communication preferences; or
• Information that you submit to our website or when you send questions or requests to us;
• Information we collect automatically when you visit our websites, including through the use of “cookies,” which we use to better understand the visitors who come to the Website, where they come from, and what content on the Website is of interest to them. Please see our Cookie statement, for further information about the cookies used on the Website and your rights in respect to the same.

In the course of providing our services, you may provide us personal information about other people. It is your responsibility to ensure that you have a legal basis to process such information and transfer it to us. Once it is transferred to us, we may then process and disclose such personal information as described in this Privacy Notice.

We may supplement the information that you provide to us by obtaining additional details from other sources. These sources may include our staff and personnel, our clients, professional advisers, agents associated with Nardello, third parties we interact with, and publicly available information.

How we use your personal information

As appropriate, we may use personal information we collect about and from you to:

Provide investigative and other services to you (e.g., we may gather and use personal information provided to us to conduct investigations on your behalf, which may involve collecting and analyzing information related to individuals or organizations to be used for the purposes of due diligence, litigation support, or other lawful purpose);

• Carry out our obligations under any contracts entered into between you and us;
• Manage our business relationship with you, for example, as part of billing and collection;
• Confirm your identity and allow us to carry out checks in the interest of security and to prevent fraud;
• Respond to your requests;
• For recruiting purposes, such as to enable us to process employment applications or to engage with third parties, such as vendors or subcontractors; or
• Comply with legal and regulatory requirements that apply to us, enforce our terms and conditions, and protect our rights, privacy, safety, or property, or that of our affiliates, you, or others.

Marketing

We may also use personal information for marketing and business development purposes, such as to:

• Enable your participation in events;
• Notify you about any changes to our services or our websites;
• Improve the services that we offer.

From time to time, we may contact you to provide you with information on our services or events that we think may be of interest to you. We will not contact you with such marketing communications unless, in accordance with applicable laws, you have consented to such contact or we have a legitimate interest, for example, if our contact relates to services that we have already provided to you.

You have the right to ask us not to process your personal information for marketing purposes at any time. You can exercise your right to prevent such processing by:

• Replying directly to the marketing message;
• Unsubscribing from marketing messages by clicking the appropriate link in any email you receive; or
• Contacting privacyinfo@nardelloandco.com.

Lawful bases

We may use or otherwise process your personal information on the grounds of one or more of the following lawful bases for processing:

• In the course of providing investigative and other services to you;
• For the performance of a contract with you or to take steps at your request prior to entering into such a contract;
• Where we use your information to achieve a legitimate interest and our reasons for using it outweigh any prejudice to your data protection rights;
• To comply with our legal obligations, including performing client due diligence, anti-money laundering, anti-bribery, sanctions or reputational risk screening; identifying conflicts of interests; for the prevention of fraud and/or other relevant background checks as may be required by applicable law and regulation and best practice; to comply with our legal or regulatory reporting obligations; and/or to protect the rights of third parties;
• Where your information is necessary to defend, prosecute or make a claim against you, us or a third party; or
• Your consent (in which case we will tell you at the time our purposes for using your personal information).

When we share your personal information

We do not sell your personal information. We may share your personal information with others, under the following circumstances:

• We may provide your personal information to our subcontractors or vendors (such as information database services, legal service or technology providers), or to subject matter experts, to allow them to assist us with delivering our services that you have requested.
• We may share personal information with third parties as required in the course of providing our services to you, including with respect to investigations, litigation, investigations, and transactions.
• We may share personal information with law enforcement agencies, governmental authorities, or regulators where we are under a duty to disclose or share such information in order to comply with any legal or regulatory obligation.
• We may disclose personal information if you have consented to any disclosure to a third party.
• We may disclose personal information among Nardello affiliation order to provide IT and system administration services and undertake other activities relating to the operations of the Nardello group as service providers or otherwise. In order for Nardello to provide services globally, all categories of personal data collected by Nardello and its affiliates may be used by Nardello and each of its affiliates to the extent necessary to achieve the purpose of such use. The Nardello entity that initially acquired the personal data will remain responsible for the personal data shared with other Nardello affiliates.
• We may disclose personal information with third party service providers and suppliers to deliver services to Nardello, including: service providers based in various countries who provide IT and system administration services; and professional advisers, including lawyers, bankers, auditors and insurers based in various countries who provide consultancy, banking, legal, insurance and accounting services. Such suppliers and service providers are required to keep confidential the information received on behalf of Nardello consistent with this Website Privacy Notice and may not use it for any purpose other than to carry out the services they are performing for Nardello.

Where we transfer, use, and store your personal information

We may transfer, use, or store your personal information outside of your home jurisdiction and, therefore, the laws of some of these destination jurisdictions may not offer the same standard of protection for personal information as your home country.

When necessary to provide our services, we transfer information to our offices in the following jurisdictions: the United States, the United Kingdom, Hong Kong, Singapore, and the United Arab Emirates.

From time to time, as disclosed above, we may transfer your personal information to our third-party service providers. Transfers to our third-party service providers are to enable them to use and store your personal information on our behalf. We have in place a program to contractually obligate our third-party service providers to offer your personal information an essentially equivalent level of protection as granted by us in this notice. This program also ensures that, where your information is transferred to any jurisdiction outside of your home country, the transfer is done in compliance with relevant data protection legislation, regulations, and guidelines issued by relevant supervisory authorities. You can request further details by contacting privacyinfo@nardelloandco.com

How long we keep your personal information

We will keep your personal information only for as long as necessary depending on the purpose for which it was provided and the periods specified in relation to the relevant system in our data protection policies.

When determining how long we will keep your personal information, we will take into account various factors, including:

• Legal obligations under applicable law to retain data for a certain period of time;
• Statute of limitations under applicable law(s);
• Status of ongoing engagements;
• Your withdrawal of consent (where applicable);
• Potential disputes; and
• Guidelines issued by relevant supervisory authorities.

How we protect the security of your personal information

We have put in place measures to protect the security of your personal information. These measures are intended to prevent your personal information from being accidentally lost, altered, disclosed, or used or accessed in an unauthorized way. In addition, we limit access to your personal information to only those employees, agents, contractors, and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Unfortunately, the transmission of information via email is not secure. Therefore, if you use email for communicating with us, we cannot guarantee that it will remain confidential while in transit.

Your rights

Under certain circumstances, and subject to legal conditions, you may have the right to object to the processing of your personal information, to request a copy of the personal information about you which we hold, or to request correction, cessation of use, or erasure of such personal information.

While you will usually not have to pay a fee to exercise these rights, in some cases, we may charge a reasonable fee if your request for access is clearly unfounded or excessive, or if you request multiple copies of the same information. Alternatively, we may refuse to comply with the request in such circumstances. We may need to request specific information from you to help us confirm your identity and ensure your right to access the information or to exercise any of your other rights.

If you are in the EEA or UK, or California, please click to find out more about these rights specific to your jurisdiction. We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

Please contact us at privacyinfo@nardelloandco.com if you wish to exercise any of these rights, if you wish to designate an authorized agent to exercise any of these rights on your behalf, if you wish to request further information about any of the above rights, or if you are unhappy with how we have

handled your personal information. We will respond to your inquiry within the timeframes required by applicable laws and regulations.

If you are not satisfied with our response or believe our processing of your information does not comply with data protection law, you can make a complaint to the Information Commissioner’s Office (“ICO”): https://ico.org.uk/global/contact-us/ or relevant supervisory authorities.

Other rights may apply in certain jurisdictions, including California.

California residents

This privacy notice for California residents applies to individuals, who reside in the State of California and supplements the information contained in Nardello’ Privacy Policy (“California Privacy Notice”). Any terms defined in the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (“CCPR”)(collectively the “CCPA”), have the same meaning when used in this supplemental notice.

When we act as a business

In certain situations, we operate as a business under the CCPA, meaning we have direct responsibilities for the personal information we collect from California Residents. This occurs when we engage in activities such as:

• Direct interactions with individuals who have a relationship with us, including clients and prospective clients.
• Marketing efforts to promote our services.
• For recruiting purposes, such as to enable us to process employment applications or to engage with third parties, such as vendors or subcontractor
• Engaging with vendors.

In these contexts, this privacy policy outlines how we handle personal information and your rights under the CCPA.

When we act as a service provider

In other situations, we serve as a service provider, processing personal information on behalf of our clients. In this role:

• We provide investigation and related services.
• The personal information we process is provided by or on behalf of our clients, and we do not have a direct relationship with the individuals whose data we handle.
• Our role is to use this information solely to deliver the services our clients have requested.

If your personal information is collected or processed by us in this capacity, this privacy policy does not directly apply to you. Instead, any questions or requests regarding your data (such as accessing, correcting, or deleting your information) should be directed to the client with whom you have the relationship.

Information we collect

During the preceding 12 months, Nardello has collected the following categories of personal information about California Consumers (including, but not limited to, clients, job applicants and/or employees):.

• Identifiers. This includes names, email addresses, postal addresses, IP addresses, Social Security number, driver’s license number, passport number, or other similar identifiers.
• Personal Information” as defined in California Civil Code section 1798.80(e). This includes a name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.
• Characteristics of protected classifications under California or federal law. This includes age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, reproductive health decision-making, military and veteran status, and genetic information (including familial genetic information).
• Commercial information. This includes records of services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies by our clients or prospective clients.
• Biometric information (defined in the CCPA to include an individual’s biological characteristics that can be used singly or in combination with other identifying data, to establish individual identity). This includes, for example, images recorded on security video, fingerprint identification, and health or exercise data to the extend volunteered by you.
• Internet or other electronic network activity information. This includes information such as website usage details, IP addresses, or the equipment used to access our network).
• Geolocation data. This includes, for example, the location in which an employee works.
• Professional or employment-related information. Includes your professional or employment-related information, including your resume, interview records, identity documents for work eligibility verification, Bar information (where applicable), offer letter, employment dates, position, salary, bonuses, benefits information, performance evaluations and employee relations information (e.g., disciplinary records).

Disclosures for a business or commercial purpose

In the preceding 12 months, Nardello has disclosed the categories of personal information listed above to its service providers for specific, limited business purposes, including for evaluating job applicants, processing payroll and employee benefits, evaluating prospective clients, among other purposes listed in the “How We Use Your Personal Information” section above.

No sharing/selling of personal information with third parties

Nardello does not “sell” personal information or “share” it with third parties for cross-context behavioral advertising (as such terms are defined by the CCPA). As such, Nardello does not have actual knowledge that it sells or shares the personal information of consumers under 16 years of age

Your rights under the CCPA

If you are a California resident, you have certain rights, subject to certain exceptions as set forth in the CCPA. Please click to find out more about these rights.

Changes to our privacy notice

We keep our Privacy Notice under regular review, and last updated it in August 2024. Any future changes will be reflected within an updated version of this “Privacy Notice” and will be available on our website. Where appropriate, we may directly notify you of changes by email.

Contacting us

It is important that the personal information that we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.

If you ever have any questions, comments, or complaints about this notice or any of its contents, please contact us at privacyinfo@nardelloandco.com and we will be pleased to assist you.