1. INTRODUCTION
Ardian is committed to processing personal data in compliance with applicable data protection laws. This privacy notice informs individuals who are prospective investors, or who represent or work for prospective institutional investors, about how Ardian France S.A., along with any other affiliated entity of Ardian Group you engage with (hereinafter “Ardian”), processes your personal data as a data controller. Throughout this notice, "you" or "your" refers to these individuals. Personal data is collected either directly from you during networking events or from publicly available sources for institutional investors. Ardian does not engage in unsolicited contact with private individuals for prospecting purposes. Ardian will only reach out if it has had a prior connection with you. This notice complements any specific privacy notices you may receive from Ardian and should be read in conjunction with those. This privacy notice applies to prospective investors. If you invest, your data will be processed as outlined in the subscription agreement.
2. PURPOSES, TYPES OF DATA AND LEGAL BASES
The following table outlines the ways in which Ardian processes your personal data, the purposes of processing, what type of data and the corresponding legal bases. Where applicable under applicable law, Ardian has identified its legitimate interests in processing the personal data. The type of data processed includes (i) Identification data such as first name, surname, signature, (ii) Contact details such as job title, role, work email address, work phone number, work address, professional qualification or background where applicable, (iii) Professional history, for example your professional qualification or background, your CV, and if you have worked for one of Ardian’s portfolio companies (iv) Correspondence, for example professional communication data such as emails and messages (v) Economic and financial data such as bank account data, tax related data, shares/interests related data, (vi) Onboarding documents, such as proof of identity, address, relevant questionnaires, ties to other investment matters including but not limited to through family or professional connections etc., (vii) Background check information that is publicly available, (viii) Know Your Customer information (KYC) such as investment goals, and (ix) Dispute information as it relates to legal claims or authorities’ requests as required. Ardian does not intentionally collect sensitive personal data, such as information about your race, ethnicity, religion, health, or genetic data. However, such data may inadvertently be acquired if you provide it to us or if it is contained in publicly available information.
| Processing activity | Purpose | Type of data | Legal basis |
| Management of the relationship with prospective investors | Undertake business development and prospecting activities by (i) establishing relationships with potential investors at networking and industry-specific events, conferences and meetings not organised by Ardian, and (ii) addressing the prospect investors’ questions or requests |
|
Legitimate interest in undertaking business development and prospecting activities to grow Ardian’s business, attract new investors, and expand its network |
| Management of the relationship with prospective investors | Undertake business development and prospecting activities by (i) establishing initial contact, (ii) fostering relationships with potential investors by inviting them to Ardian events, and (iii) sharing newsletters and relevant marketing materials |
|
Consent you give when providing your contact details to be contacted and to receive marketing material. |
| Management of the relationship with prospective investors | Maintain Ardian customer relationships database |
|
Legitimate interest in maintaining a customer relationship database to manage Ardian’s interactions with current and potential investors, provide them with relevant information, and improve their overall experience |
| Management of the relationship with prospective investors | Onboard prospective investors on the Trustview platform and manage the account once the prospective investor has shown interest in investing and agreed to be onboarded on the platform (for details of processing through Trustview please refer to relevant notices on the platform) |
|
Legitimate interest in onboarding prospective investors onto the Trustview platform to facilitate the investment process and manage their accounts |
| Management of the relationship with prospective investors | Manage the organization and logistics of events attended by prospective investors (for details of processing when you attend events please refer to relevant notices and disclaimers in the event forms) |
|
Legitimate interest in organizing and managing events to promote Ardian’s business, network with potential investors, and generate interest in its offerings |
| Management of the relationship with prospective investors | Take steps prior to entering into a contractual relationship to support the onboarding of the prospect investor, including determining the prospect investor’s eligibility to invest, preparing and sharing documentations, proceeding to signature of subscription agreement and other relevant documentation |
|
Necessity of processing to carry out pre-contractual measures taken at request |
| Conducting background checks on prospective investors | Perform background checks on prospective investors to establish if the potential relationship and deals with them is legal and complies with various sanctions regimes worldwide |
|
Legal obligation to comply with sanctions (e.g. restrictive economic measures by the European Commission targeting specific countries) |
| Compliance with applicable laws, regulations and competent authorities |
Comply with any legal, regulatory and reporting obligations, guidelines or directives prescribed by competent administrative bodies or regulators (including, but not limited to, reporting to regulatory bodies, and conducting audits, due diligence and investigations), in particular conducting checks as they relate to the fight against money laundering and the financing of terrorism requirements |
|
Legal obligation, in particular Art. 320-14 to 320-23 du RGAMF, or its equivalence depending on the applicable jurisdiction |
| Management of categorisation of clients and Know Your Customer checks |
Conducting categorisations of clients and Know Your Customer checks to assess that the service to clients is suitable |
|
Legal obligation, in particular Art.314-4 and 314-9 of the RGAMF |
| Management of disputes |
Establish, manage, exercise, or defend legal claims, and support any request or defence, in particular within the framework of a summons before any jurisdictional, and/or administrative authority, arbitration or mediation body |
|
Ardian's legitimate interest in preserving its rights and defending its interests including in the context of disputes or contentious proceedings |
3. DATA SHARING AND TRANSFERS
To the extent this is necessary, Ardian communicates your personal data to other entities of the Ardian group, and with third-party service providers and suppliers which assist Ardian in fulfilling the purposes specified in this notice, for example administrators may support Ardian in processing your onboarding documentation if you choose to proceed with an investment, or an event planning agency may process information you fill in in event forms when they support the management of Ardian events that you are attending . Furthermore, as the case may be, Ardian may be required by law to share your personal data with competent courts and any other governmental and/or public authorities requesting access to your personal data. In any event, Ardian communicates your personal data to the above recipients on a strict need-to-know basis and only as necessary for fulfilling duly identified processing purposes. Disclosure to third parties is subject to confidentiality, privacy, and security measures as appropriate to the circumstances of the disclosure. Please also note that Ardian does not sell personal information, including information of California residents. Ardian may share your personal data with third parties, including other entities of the Ardian Group, some of which are located outside the European Economic Area (EEA). These countries may not offer the same level of data protection as the EEA (for example, China, Singapore, and the USA). To safeguard your data, Ardian has implemented robust security measures. These include Binding Corporate Rules (BCRs) governing data transfers within the Ardian Group and Standard Contractual Clauses for transfers to external third parties. You can find a summary of our BCRs by clicking here or by contacting our Data Protection Officer (details in Section 6).
4. DATA RETENTION PERIODS
The retention periods for personal data depend on the respective purpose for which the personal data is processed, and the respective tools used to process such data. The criteria used to determine the applicable retention periods are that Ardian will retain personal data for as long as (i) necessary for the respective purpose, (ii) necessary to carry out the relationship with the prospective investor, (iii) the relevant individual has consented to the processing, and/or (iv) is required by applicable statutory retention laws. When deciding how long to retain personal data, Ardian also takes into account its legal and regulatory obligations, the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of personal data, the purposes for which Ardian processes personal data and whether it can achieve those purposes through other means. Ardian may also retain personal data to investigate or defend against potential legal claims in accordance with the limitation periods of countries where legal action may be brought.
5. YOUR RIGHTS AND OBLIGATIONS
Under certain circumstances, you benefit from various rights regarding the processing of your personal data. These are as follows:
- right to request from Ardian access to and rectification or erasure of your personaldata;
- right to request from Ardian restriction of the processing concerning you;
- right to object to the processing of your personal data;
- right to portability of your personal data;
- right to specify guidelines regarding the use of your personal data after your death;
- if you were to provide your consent, (for example to receive newsletters from Ardian), the right to withdraw the consent you gave; and
- right to lodge a complaint with the relevant supervisory authority, such as the French Data Protection Authority (CNIL).
Under certain circumstances and if you are a California resident, you also have the following rights:
- Right to know about the processing of your information by Ardian in the preceding 12 months, including (i) the categories and specific pieces of personal information Ardian has collected about you; (ii) the categories of sources from which Ardian has collected your personal information, and the business or commercial purpose for the collection; (iii) the categories of third parties with whom Ardian has shared your personal information and the business or commercial purpose for said sharing. Please note that you may only make a ‘right to know’ request to Ardian up to two times in any twelve-month period.
- Right to deletion of your personal data (subject to Ardian’s right to maintain your personal data for specific purposes permitted under the Californian law).
- Right to opt-out of the sale of your personal data to third parties.
- Right to non-discrimination when exercising any of the rights listed above (and any other rights under the California Consumer Privacy Act and all related amendments and regulations).
Ardian is committed to utmost care when it comes to protecting your personal data and complying with the applicable data protection legal framework. This is the reason why Ardian requires your assistance to this end. Please keep us informed if the personal data you shared with Ardian becomes obsolete or is inaccurate. In addition, in the event you would provide Ardian with information enabling to identify directly or indirectly any other natural persons, you represent and warrant that, prior to sharing this information with Ardian, such other natural persons have been provided with this notice and, to the extent applicable, have consented to the processing of their data.
6. CONTACT DETAILS
Should you have any questions or requests regarding the processing of your personal data by Ardian or would like to submit requests to exercise one of your rights specified in Section 5 (Your rights and obligations) above, please feel free to contact Ardian’s data protection officer(DPO) by registered mail at Ardian, Data Protection Officer, 20 Place Vendôme, 75001 Paris, France, by email at dataprivacy@ardian.com, or within the U.S. (only for California residents) by calling toll-free 833-544- 9273.