Privacy Policy

Last Updated: This Privacy Policy was last updated on November 19, 2025.

Table of Contents

• Information We Collect
  • Information You Provide To Us
  • Information We Obtain From Other Sources
  • Information We Collect Automatically
• How We Use Information
• How We Disclose Information
• Cookies and Other Tracking Technologies
• Information for California Residents
  • Processing of Personal Information
  • Accessing, Correcting, and Deleting Your Personal Information
• Links to Third Party Websites
• Data Security and Retention
• Children’s Privacy
• Changes to this Privacy Policy
• How to Contact Us
• EEA-UK Privacy Supplement
  • Information We Collect
  • How We Use Information
  • How We Share Information
  • Data Transfers
  • Data Security and Retention
  • Your Rights
  • Complaints

This Privacy Policy describes how Graham Partners (“Graham Partners”, “we”, “our”, or “us”) will use and disclose the information we collect or receive from or about you when you visit grahampartners.net (“Website”) and any of our websites that link to this Privacy Policy, including through our Partner portal (collectively, the “Services”). If you are an investor or potential investor, our collection and processing of information about you is governed by our separate Investor Privacy Policy. This Privacy Policy does not apply to other third party services, websites and applications accessed by or through our Website or other websites that we may operate but on which a link to this Privacy Policy does not appear. We are committed to protecting your personal information. If you have any questions or concerns about our Privacy Policy, or our practices with regards to information we collect from or about you, please contact us at partnersupport@grahampartners.net.

If you are located in the United Kingdom (“UK“), the European Union (“EU“) or the European Economic Area (“EEA“) or if our processing of your personal information is otherwise subject to applicable laws and regulations relating to privacy, protection or processing of personal information in the EEA, EU and UK, including the General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR“) and the UK’s equivalent to the EU GDPR, (the “EEA-UK Privacy Laws“), please also refer to our EEA-UK Privacy Supplement below.

Information We Collect

We collect information about you in various ways. For example, you may provide personal information directly to us, we may collect certain information about you automatically through your use of the Services, or we may obtain information about you from third parties who are acting on our behalf.

Information You Provide To Us

When you interact with us through our Services, we may collect or receive information about you. For example, you provide information to us when you submit a form through the “Contact Us” page, express interest in obtaining information about us or our Services, or when you use our Services. When you are navigating through our Website, we record your IP address. Generally, you control the amount and type of information you provide to us when using our Services. Some of the information you provide to us is “personal information.” The personal information that we collect from you depends on the context of your interaction with us and our Services, the choices you make when you use our Services, and the products and features you use. The personal information we collect or receive may, for example, include the following:

• Name
• Job title and company name
• Telephone or fax number
• Address
• Email address
• Account log-in credentials for logging into the Partner portal
• Bank account details
• Message content submitted by you through our Contact Us page

Information We Obtain From Other Sources

We may also engage service providers, such as investment data companies, to collect information from or about you on our behalf.

Information We Collect Automatically

When you use our Services, we automatically collect certain information about you when you visit our web pages, open our emails, or otherwise use the Services. Automatically collected information may, for example, include the following:

• Your IP address.
• The type of browser and operating system you are using.
• The domain name of your Internet service provider.
• Information about the content you view and the features you access on our Services, including your activity and behavior on our Website.
• Information regarding when you access our Services, including information regarding the duration of your engagement with certain aspects of the Services.

This data may be combined and linked with data from other sources.

We use cookies to collect and store information when you visit our Services. For more information, please see Cookies and Other Tracking Technologies below.

We may also deidentify your information such that it cannot reasonably be used to infer information about you or otherwise be linked to you, or we may collect information that has already been deidentified. We may use such information for any lawful purpose. To the extent we possess or process any deidentified information, we will maintain and use such information in deidentified form and not attempt to reidentify the information, except for the purpose of determining whether our deidentification process satisfies legal requirements.

How We Use Information

We may use the information collected pursuant to this Privacy Policy in the following ways:

• To operate and provide the Services to you, or to fulfill any other purpose for which you provide us with information.
• To deliver the information, products or services you have requested from us.
• To create and disclose aggregate statistics and reports regarding visitors to our Services and users of our Services.
• To reach out to you about and promote new information, products or Services to you that we believe you may be interested in.
• To help us to improve our Services and to deliver a better and more personalized experience, including by enabling us to estimate our audience size and usage patterns, store information about your preferences and recognize you when you use our Services.
• To carry out our obligations and enforce our rights arising from any contracts entered into between you and Graham Partners and as we believe is necessary or appropriate to protect, enforce or defend the legal rights, privacy, safety or property of the Services, its employees or agents, or other users or to comply with applicable law.
• To communicate with you, including to notify you about changes to our Services. In any other way we may describe when you provide the information, or otherwise at your direction or with your consent.
• As permitted by law or as we may notify you.

How We Disclose Information

We may disclose the information that we collect about you or that you provide to us, including any personal information, as follows:

• We disclose information with service providers, including our business partners and vendors, who help us provide the Services and support our business, including for tax preparation, cloud computing, web analytics, marketing and advertising, security and customer relationship management.
• We will disclose information we collect about you when required to do so by law, for example, in response to a court order or a subpoena. We also may disclose such information in response to a law enforcement agency’s request.
• We may disclose your information with our affiliates.
• We may disclose your information where necessary and permitted by law for the establishment, exercise, or defense of legal claims, to protect the rights and property of Graham Partners and its affiliates and their respective agents, customers, and others, including to enforce our agreements, policies, and terms of use, or to protect the personal safety of any person.
• With your permission or upon your direction, we may disclose your information with a third party or for other purposes.

In addition, please note that if Graham Partners or any of its affiliates, subsidiaries or lines of business is merged, acquired, divested, financed, sold, disposed of or dissolved, including through merger, consolidation, sale or divestiture of assets, or other business transaction, information collected pursuant to this Privacy Policy and any other information we possess about you, including personal information, may, in whole or in part, be sold, disposed of, transferred, divested, or otherwise disclosed as part of or in contemplation of that transaction or proceeding.

We do not “sell” or “share” (as those terms are defined under the CCPA) your personal information, nor have we done so in the preceding 12 months. Further, we do not have actual knowledge that we “sell” or “share” personal information of individuals under 18 years of age.

Cookies and Other Tracking Technologies

Information regarding how you access our Website (e.g., browser type, access times and IP address) and your hardware and software is automatically collected through the use of cookies (a small text file placed on your hard drive) or other technologies or tools. This information is used to improve the Website performance’s and for our business purposes, including to help provide you with a better experience when you browse the Website. Where cookies are not necessary for us to provide the Services you have requested or for the functioning of this Website, we will ask you to consent to their use. You may opt-in to accept cookies automatically by changing the settings on your browser. If you opt-out of certain cookies, you may not be able to access certain parts of this Website. You may wish to visit www.aboutcookies.org, which contains comprehensive information about types of cookies, how they are used and how you manage your cookie preferences.

Subject to your consent, the Website will place the cookies listed below:

Information for California Residents

Processing of Personal Information

If you are a California resident, we collect and disclose, and in the preceding 12 months have collected and disclosed for a business purpose the following categories of information (sensitive information denoted by a *): identifiers; Internet or other similar network activity; personal information categories listed in the California Customer Records statute (like your full name or contact information); commercial information; professional or employment information; account log-in credentials for the Partner Login portal*; and Social Security number or other tax identifier*. The specific purposes for which we collect your personal information and the categories of sources from which we collect your personal information are described in the “Information We Collect” and “How We Use Information” sections above. For further information on the purposes for which we disclosed personal information over the preceding 12 months, see the “How We Disclose Information” section above. We only use and disclose sensitive personal information for purposes specific in the CCPA or otherwise in line with your consent.

Accessing, Correcting, and Deleting Your Personal Information

If you are a California resident, you have certain rights in relation to your personal information under the California Consumer Privacy Act (“CCPA”). To exercise these rights see the “Exercising Your California Privacy Rights” section below.

• Right to Know. You have the right to know and see what data we have collected about you, including:
  • The categories of personal information we have collected about you;
  • The categories of sources from which the personal information is collected;
  • The business or commercial purpose for collecting your personal information;
  • The categories of third parties to whom we have disclosed your personal information; and
  • The specific pieces of personal information we have collected about you.
• Right to Delete. You have the right to request that we delete the personal information we have collected from you (and direct our service providers to do the same).
• Right to Correct. You have a right to request that we correct inaccurate personal information we maintain about you.
• Other Rights. You also have the right not to be discriminated against for exercising any of the rights listed above.
• Exercising Your California Privacy Rights. To request access to or deletion of your personal information, or to exercise any other data rights under California law, please contact us using one of the following methods:
  • Contact Us Webform: Submit your request here
  • Email: Submit your request by emailing partnersupport@grahampartners.net.
  • Telephone: If you would like to contact us by telephone without incurring telephone charges, please submit your request and telephone number through the online form above, or by emailing partnersupport@grahampartners.net.
• Response Timing and Format. We may require certain information from you in order to verify your identity and respond to your request. We aim to respond to requests for access or deletion within 45 days of receipt. If we require more time, we will inform you of the reason and extension period in writing.

Links to Third Party Websites

Our Website and some of our Services on which a link to this Privacy Policy appears contain links to third party sites and services whose privacy practices may be different than ours. We also allow you to connect with other third party sites and services. We are not responsible for the privacy practices of third party sites and services and you should consult the other third party sites’ and services’ privacy notices in order to better understand their privacy practices.

Data Security and Retention

We have put in place reasonable administrative, technical, and physical safeguards to help prevent unauthorized access, maintain data security and correctly use the information we collect from and about you. However, no system can be completely secure and we do not guarantee that unauthorized disclosures and access will not happen. Although we take reasonable measures to safeguard against unauthorized disclosures of information, we cannot assure you that your personal information or other information will never be disclosed in a manner that is inconsistent with this Privacy Policy.

We take reasonable steps to accurately record the personal information that you provide to us pursuant to this Privacy Policy and any subsequent updates to such information. We encourage you to review, update, and correct the personal information that you provide to us pursuant to this Privacy Policy. Please contact us at partnersupport@grahampartners.net in order to do so.

We retain your information for as long as is reasonably necessary for the purposes specified in this Privacy Policy. When determining the length of time to retain your information, we consider various criteria, including whether we need the information to comply with our legal obligations and business requirements, resolve a dispute or to enforce our agreements, terms of service and policies.

Children’s Privacy

Our Services are not intended for users under the age of 18, and Graham Partners does not knowingly collect information from anyone under the age of 18. No one under the age of 18 is permitted to access or use the Services or provide Graham Partners with personal information

Changes to this Privacy Policy

This Privacy Policy may be changed by Graham Partners or its affiliates at any time and such changes will apply to information we collected from you pursuant to a previous version of the privacy policy. The revised Privacy Policy will be posted on the appropriate portion(s) of our Website or Services and will indicate at the top when it was most recently updated. We encourage you to periodically check back to review this Privacy Policy so that you know what information we collect, how we use it and to whom we disclose it. If we make material changes to how we process your personal information, we will take reasonable steps to notify you in accordance with applicable law.

How to Contact Us

If you have any questions or concerns about this Privacy Policy or its implementation, please contact us at partnersupport@grahampartners.net.

EEA-UK PRIVACY SUPPLEMENT

This EEA-UK Privacy Supplement supplements the Privacy Policy with respect to our use of personal information to the extent that EEA-UK Privacy Laws apply to our processing of your personal information. You do not need to take any action as a result of this EEA-UK Privacy Supplement, but you do have certain rights as described below in the section headed Your Rights.

Information required to be disclosed under this EEA-UK Privacy Supplement regarding the collection of your personal information that is not set forth in this EEA-UK Privacy Supplement is otherwise set forth in the Privacy Policy above. To the extent there is any conflict in respect of any processing subject to EEA-UK Privacy Laws between the Privacy Policy and this EEA-UK Privacy Supplement, this EEA-UK Privacy Supplement shall apply. Please read this EEA-UK Privacy Supplement carefully.

To the extent that EEA-UK Privacy Laws apply to our collection and processing of your personal information, Graham Partners will be the “controller”. In simple terms, this means we: (i) “control” the personal information that we collect from you or other sources; and (ii) make certain decisions on how to use and protect such personal information.

If you have any questions regarding our use of your personal information, or this EEA-UK Privacy
Supplement, please contact us at partnersupport@grahampartners.net.

Information We Collect

We collect and process limited categories of personal information obtained from you and other third parties and/or publicly available sources depending on the product or service you have requested from us and/or the nature of your interaction with us as further set forth in the Information We Collect section in the Privacy Policy above.

We do not collect any special categories of personal information about you (this includes details about
your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions,
trade union membership, information about your health and genetic and biometric data), although there
may be limited circumstances where we need to collect this type of personal information, or it is collected
incidentally. Nor do we collect any information about criminal convictions and offences.

If we require your personal information due to a legal requirement or obligation or in order to perform a contract with you, we will make you aware of this at the time we collect your personal information, and the possible consequences of you failing to provide this personal information. Failure to provide this information means that we cannot provide our Services to you. In this case, we may have to cancel a Services with you, but we will notify you if this is the case at the time.

How We Use Information

We rely on various legal bases under the EEA-UK Privacy Laws in order to process your personal information, as we have set forth below.

No automated decision-making, including profiling, is used when processing your personal information.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.

How We Share Information

We may share your personal information with certain service providers as necessary to fulfil the purposes set out in How We Share Information section of the Privacy Policy. We reserve the right to disclose your personal information as required by law, or when we believe that disclosure is necessary to protect our rights and/or comply with a judicial proceeding, court order, request from a regulator, national security, for the purposes of public importance or any other legal or investigatory process involving us. Should we, or any of our affiliated entities, be the subject of a takeover, divestment or acquisition we may disclose your personal information to the new owner of the relevant business and their advisors on the basis of our legitimate interest.

Data Transfers

To the extent your personal information is transferred to a Non-Equivalent Country (as defined below), such transfers will only be made in accordance with EEA-UK Privacy Laws. For the purposes of this EEA-UK Privacy Supplement, “Non Equivalent Country” means a country or territory other than (i) a member state of the EEA; (ii) the UK; or (iii) a country or territory which has at the relevant time been decided by the European Commission, the Government of the UK or the UK Information Commissioner’s Office (as applicable) in accordance with the applicable EEA-UK Privacy Laws to ensure an adequate level of protection for personal information.

For further information about the safeguards/derogations used, please contact us at partnersupport@grahampartners.net.

Data Security and Retention

We take measures designed to protect the security of your personal information as described in the Data Security and Retention section in the Privacy Policy above. We will retain your personal information in line with our retention policies only for as long as is reasonably necessary for the purposes set out in the Privacy Policy unless a longer retention period is required by law or regulatory obligations which apply to us, or where necessary to defend or pursue legal claims.

Your Rights

To the extent the EEA-UK Privacy Laws apply to our processing of your personal information, you may have the following rights (subject to certain limitations):

• Access: You have the right to ask for a copy of the personal information that we hold about you free of charge, however we may charge a “reasonable fee,” if we think that your request is excessive, to help us cover the costs of locating the information you have requested.
• Correction: You have the right to notify us of changes to your personal information if it is inaccurate or it needs to be updated.
• Deletion: If you think that we should not be holding or processing your personal information anymore, you may request that we delete it. Please note that this may not always be possible due to legal and regulatory obligations.
• Restrictions on use: You have the right to request that we stop processing your personal information (other than storing it), if: (i) you contest the accuracy of it (until the accuracy is verified); (ii) you believe the processing is against the law; (iii) you believe that we no longer need your personal information for the purposes for which it was collected, but you still need your personal information to establish or defend a legal claim; or (iv) you object to the processing, and we are verifying whether our legitimate grounds to process your personal information override your own rights.
• Object: You have the right to object to processing, including: (i) for direct marketing; (ii) for research or statistical purposes; or (iii) where processing is based on legitimate interests, unless we reasonably demonstrate compelling legitimate grounds for the processing.
• Portability: If you wish to transfer your personal information to another organisation (and certain conditions are satisfied), you may ask us to do so, and we will send it directly if we have the technical means.
• Withdrawal of consent: If you previously gave us your consent (by a clear affirmative action) to allow us to process your personal information for a particular purpose, but you no longer wish to consent to us doing so, you can contact us to let us know that you withdraw that consent. This will not affect the lawfulness of processing based on consent before its withdrawal.

These rights are not absolute and in certain circumstances their exercise may not be possible including when personal information must be maintained to comply with applicable laws.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

To exercise these rights and controls, please contact us at partnersupport@grahampartners.net.

Complaints

Should you wish to lodge a complaint with regards to how your personal information has been processed by us under:

• the UK GDPR and/or Data Protection Act 2018, please contact the UK Information Commissioner’s Office – https://ico.org.uk/global/contact-us; or
• the EU GDPR, please contact your local supervisory authority in particular in the EU Member State of your habitual residence, place of work, or place of the infringement, concern or complaint.

We would, however, appreciate the opportunity to address your concerns before you approach the relevant supervisory authority, so please contact us in the first instance by reaching out to us at partnersupport@grahampartners.net.