Privacy Policy

1. Introduction

Scotland Fund (“Scotland Fund”, “we”, “us”, or “our”) is committed to protecting the privacy and security of personal data. This Privacy Policy explains how we collect, use, disclose, transfer, and safeguard personal data when you interact with us, visit our website (the “Website”), access our investor portal, attend our events, or otherwise communicate with us.

Scotland Fund is a private infrastructure and hospitality platform operating across the United Kingdom, with a particular focus on Scotland. The Website is provided for general corporate and informational purposes only. It is not an offer, invitation, inducement, or solicitation to invest, subscribe for, purchase, or otherwise acquire any securities, interests, or investment products, and is not directed at the public in any jurisdiction. Please read Section 17 carefully before relying on any information presented on the Website.

This Policy applies to portfolio company personnel, counterparties, service providers, employees, job applicants, existing investor portal users, and visitors to our digital properties.

We act as a data controller in respect of the personal data described in this Policy unless we state otherwise. Where we process personal data on behalf of another controller (for example, on behalf of a portfolio company), we act as a data processor and the relevant controller’s privacy notice will apply in addition to this one.

2. Who We Are and How to Contact Us

Controller: Scotland Fund (together with its affiliated vehicles, managers, and advisers, collectively the “Scotland Fund Group”).

Address: Scotland Fund, Scottish Enterprise Technology Park, G75 0QU, United Kingdom.

Privacy Contact: legal@scotlandfund.com

You have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at any time. Their contact details are available at www.ico.org.uk or by telephone on 0303 123 1113. Where applicable, you may also contact your local supervisory authority in the European Economic Area or other jurisdiction.

3. Scope and Application

This Policy applies to personal data we process about the following categories of individuals:

• Personnel of portfolio companies, target companies, joint venture partners, and counterparties;
• Service providers, professional advisers, and their personnel;
• Users of our investor portal (being existing counterparties to whom access has been granted);
• Visitors to our Website, subscribers to our communications, and attendees at our events;
• Job applicants, employees, contractors, and secondees;
• Members of the public who correspond with us or whose data we receive in the course of due diligence, transactions, or compliance.

This Policy does not apply to anonymised or aggregated data that cannot reasonably be used to identify an individual.

4. Personal Data We Collect

The categories of personal data we collect depend on the nature of your relationship with us.

Website visitors. Our public Website is presentational and does not require you to provide personal data to browse it. We do not retain personal data from general Website visits beyond limited technical data (such as IP address, browser type, and pages viewed) collected automatically through cookies and server logs for security and analytics purposes, as described in Section 12. If you choose to contact us by email or other means via details provided on the Website, we will receive and process the personal data you choose to send us.

Investor portal users. Where you have been granted access to our investor portal as an existing counterparty, we collect login credentials, authentication data, IP address, device and session information, access logs, and any information you submit or view through the portal.

Identity and contact data including full name, title, date of birth, nationality, photograph, signature, residential and business addresses, email addresses, telephone numbers, and employer details.

Professional and financial data including job title, professional qualifications, employment history, source of wealth and source of funds information, bank account details, tax residency and tax identification numbers, and transaction history with us.

Identification and verification data including passport, driving licence, national identity card, utility bills, proof of address documentation, and information obtained through our third-party providers in connection with anti-money laundering, sanctions screening, politically exposed person checks, adverse media searches, and credit reference checks. This may include data classified as “special category” or criminal offence data under data protection law, which we process only where lawfully permitted.

Due diligence data in relation to transactions, including information about directors, shareholders, beneficial owners, and key personnel of counterparties, target companies, and portfolio companies.

Correspondence and engagement data including the content of emails, letters, telephone calls (which may be recorded where lawful and notified), meeting notes, and records of in-person interactions.

Recruitment data including curricula vitae, references, right-to-work documentation, interview notes, and assessment results.

CCTV and physical access data when you visit our offices or premises operated by our portfolio companies, including images captured by closed-circuit television and visitor logs.

5. How We Collect Personal Data

We collect personal data directly from you when you correspond with us; access our investor portal as an existing counterparty; complete recruitment applications; attend our meetings or events; or visit our offices.

We also collect personal data from third parties and publicly available sources, including:

• Your employer, professional adviser, intermediary, or authorised representative;
• Companies House, the Land Registry, the Registers of Scotland, court registers, and equivalent public registries;
• Third-party providers engaged to conduct anti-money laundering, know-your-customer, sanctions, politically exposed person, and adverse media screening;
• Credit reference and fraud prevention agencies;
• Background check providers (with your consent where required);
• Professional advisers, including lawyers, accountants, and consultants;
• Counterparties, co-investors, and joint venture partners;
• Social and professional networking platforms such as LinkedIn;
• News, media, and subscription databases.

Where we receive personal data about you from third parties, we will, where required, ensure those third parties have a lawful basis to share it with us.

6. Purposes and Legal Bases for Processing

Under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, we must have a lawful basis for processing personal data. The principal purposes for which we process personal data, and the corresponding legal bases, are set out below.

Managing existing counterparty and portfolio relationships. Administering our relationships with existing counterparties, communicating with them and their representatives, providing reporting where contractually agreed, and operating our investor portal for those who have been granted access. Legal bases: performance of a contract; legitimate interests in managing our business and counterparty relationships; compliance with legal obligations.

Anti-money laundering, counter-terrorist financing, and sanctions checks. Verifying identity, conducting customer due diligence and enhanced due diligence (via our third-party screening provider), screening against sanctions and politically exposed persons lists, and reporting suspicious activity where required by law. Legal bases: compliance with legal obligations under applicable anti-money laundering, counter-terrorist financing, and sanctions legislation, including the Proceeds of Crime Act 2002, the Terrorism Act 2000, and the Sanctions and Anti-Money Laundering Act 2018; substantial public interest in preventing or detecting unlawful acts (where special category or criminal offence data is involved).

Due diligence, transactions, and asset management. Evaluating, executing, and managing infrastructure and hospitality activity, including engagement with counterparties, target companies, and portfolio companies. Legal bases: legitimate interests in conducting our business; performance of contractual or pre-contractual steps.

Legal and tax compliance. Complying with our obligations under applicable laws, including tax reporting regimes (such as FATCA, CRS, and UK tax legislation), company law, employment law, and health and safety law. Legal bases: compliance with legal obligations; legitimate interests.

Communications and engagement. Responding to enquiries received through the contact details published on the Website, and sending updates about Scotland Fund, our activities, events, and other corporate content where you have requested to receive them. Legal bases: consent (where required); legitimate interests in conducting and presenting our business. You may opt out at any time as described in Section 11.

Website and investor portal operation and security. Operating, maintaining, securing, and improving our Website, investor portal, and digital systems, and detecting and preventing fraud, cyber-attacks, and other unlawful activity. Legal bases: legitimate interests; compliance with legal obligations.

Recruitment and employment. Processing job applications, conducting interviews, performing pre-employment checks, and administering employment. Legal bases: pre-contractual steps; performance of an employment contract; legal obligations; legitimate interests; consent (where applicable).

Litigation, disputes, and corporate transactions. Establishing, exercising, or defending legal claims, and undertaking corporate transactions including mergers, acquisitions, restructurings, and disposals. Legal bases: legitimate interests; legal obligations; establishment, exercise, or defence of legal claims.

Premises security. Operating CCTV and visitor management systems at our offices. Legal bases: legitimate interests in maintaining the security of our premises, personnel, and assets.

Where we rely on legitimate interests, we have undertaken a balancing assessment to ensure our interests are not overridden by your rights and freedoms. You may request further information about this assessment by contacting us at legal@scotlandfund.com.

7. Sharing Personal Data

We share personal data only where necessary and with appropriate safeguards in place. The categories of recipients with whom we may share personal data include:

Scotland Fund Group entities, including affiliated vehicles, managers, advisers, and special purpose vehicles, for the purposes described in this Policy.

Portfolio companies and target companies, where relevant to the management of our activities or the evaluation of transactions.

Co-investors, syndicate members, and joint venture partners.

Professional advisers, including legal counsel, accountants, auditors, tax advisers, consultants, and corporate finance advisers.

Service providers, including banks, technology and investor portal providers, cloud hosting providers, communications providers, and document management providers.

Third-party compliance and screening providers, including providers of anti-money laundering, know-your-customer, sanctions, politically exposed person, adverse media, and credit reference services.

Governmental bodies, regulators, and law enforcement, including HM Revenue & Customs, the National Crime Agency, the Information Commissioner’s Office, Companies House, the Office of Financial Sanctions Implementation, and equivalent overseas authorities, where required by law or where we determine disclosure is appropriate.

Counterparties and their advisers, in the context of transactions, financings, and disputes.

Acquirers and their advisers, in the event of a sale, merger, reorganisation, or other corporate transaction involving Scotland Fund or its assets.

Courts, tribunals, and other dispute resolution bodies, where necessary in connection with legal proceedings.

We do not sell personal data to third parties.

8. International Transfers

Personal data is stored and processed in the United Kingdom and the United States, and may be transferred to other jurisdictions where our service providers or Scotland Fund Group entities operate.

Where we transfer personal data outside the UK, we ensure an appropriate safeguard is in place, such as:

• A finding of adequacy by the UK Government in respect of the destination jurisdiction (including, where applicable, the UK Extension to the EU-US Data Privacy Framework for transfers to certified US recipients);
• The International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses;
• Binding corporate rules; or
• Another lawful transfer mechanism permitted under the UK GDPR.

You may request a copy of the safeguards we rely on by contacting us at legal@scotlandfund.com.

9. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including for the purposes of satisfying any legal, tax, accounting, or reporting requirements.

In particular:

• Counterparty records and identity verification documentation are retained for a minimum of five years (and typically longer) from the end of our relationship, in line with applicable anti-money laundering record-keeping requirements;
• Transaction and contractual records are retained for the duration of the relevant limitation periods under Scots and English law (typically up to 20 years for prescriptive purposes under the Prescription and Limitation (Scotland) Act 1973);
• Tax records are retained in accordance with HMRC and other applicable tax authority requirements;
• Communications data is retained until you withdraw consent or object, and then for a short period to record the withdrawal;
• Recruitment data for unsuccessful applicants is typically retained for 12 months;
• CCTV footage is typically retained for 30 days unless required for an investigation;
• Investor portal access logs are typically retained for 12 months for security purposes.

Where personal data is no longer required, we will securely delete or anonymise it.

10. Data Security

We have implemented technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include access controls, encryption, network security, multi-factor authentication for our investor portal, staff training, vendor due diligence, and incident response procedures.

No method of transmission over the internet or method of electronic storage is wholly secure, and we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO and, where required, affected individuals in accordance with our legal obligations.

11. Your Rights

Subject to certain exemptions and conditions, you have the following rights under the UK GDPR:

• The right to be informed about how we process your personal data;
• The right of access to your personal data;
• The right to rectification of inaccurate or incomplete personal data;
• The right to erasure of your personal data (the “right to be forgotten”);
• The right to restrict processing of your personal data;
• The right to data portability;
• The right to object to processing, including for direct marketing purposes;
• The right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects;
• The right to withdraw consent at any time, where we rely on consent as the legal basis for processing.

To exercise any of these rights, please contact us at legal@scotlandfund.com. We may need to verify your identity before responding to your request. We will respond within one month, although this period may be extended by up to two further months for complex or numerous requests.

We will not charge a fee for exercising your rights unless your request is manifestly unfounded or excessive.

You also have the right to lodge a complaint with the ICO (see Section 2).

12. Cookies and Similar Technologies

Our Website uses cookies and similar technologies to operate the Website and investor portal, analyse usage, and improve your experience. Cookies are small text files placed on your device when you visit a website.

We use the following categories of cookies:

• Strictly necessary cookies, which are essential for the operation of the Website and investor portal (including authentication and session management) and cannot be switched off;
• Performance and analytics cookies, which help us understand how visitors interact with our Website;
• Functionality cookies, which enable enhanced features and personalisation;
• Targeting cookies, which may be set by us or by third parties to build a profile of your interests (used only with your consent).

You can manage your cookie preferences through the cookie banner displayed on your first visit to the Website and at any time via our cookie settings. Most browsers also allow you to control cookies through their settings.

13. Automated Decision-Making

We do not currently make decisions about you based solely on automated processing that produce legal or similarly significant effects. Where this position changes, we will update this Policy and notify affected individuals.

Certain compliance screening processes operated by our third-party providers (for example, automated sanctions screening) involve automated processing, but the outcomes are reviewed by trained personnel before any decision is taken.

14. Children’s Data

Our Website and activities are directed at adults, including portfolio companies, counterparties, professional advisers, and prospective employees. We do not knowingly collect personal data from children under the age of 16. If you believe we have inadvertently collected such data, please contact us at legal@scotlandfund.com.

15. Third-Party Links

Our Website may contain links to third-party websites, services, and resources. We are not responsible for the privacy practices or content of such third parties. We encourage you to review the privacy policies of any third-party services you visit.

16. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The “Last updated” date at the top of this Policy indicates when it was most recently revised. Material changes will be notified to you by email or by a prominent notice on the Website.

17. Nature of the Website and Regulatory Status

Purpose of the Website. The Website is a presentational platform. It exists solely to describe Scotland Fund, its team, its sectors of activity, and matters of general public and corporate interest. The Website is not transactional, is not interactive in any commercial sense, and is not a means by which Scotland Fund engages, solicits, markets to, or contracts with any person.

No financial promotion, no offer, no solicitation. Nothing on the Website, in this Policy, in any document made available via the Website, or in any communication issued by Scotland Fund constitutes, or is intended to constitute:

• An invitation or inducement to engage in investment activity within the meaning of section 21 of the Financial Services and Markets Act 2000 (“FSMA”);
• A financial promotion of any kind;
• An offer, recommendation, or solicitation to buy, sell, subscribe for, underwrite, or otherwise acquire or dispose of any securities, partnership interests, fund units, debt instruments, or other investment instruments;
• Financial, investment, tax, legal, accounting, or other professional advice;
• A recommendation, endorsement, or opinion regarding any investment, transaction, strategy, or course of action.

Scotland Fund is not raising capital. Scotland Fund is not raising, marketing, offering, or seeking capital, commitments, subscriptions, or investments from any person, of any class, in any jurisdiction, whether through the Website or otherwise. The Website is not directed at, and must not be relied upon by, any person for the purpose of making any investment or commercial decision.

No regulated activity. Scotland Fund does not carry on any regulated activity within the meaning of FSMA and is not authorised or regulated by the Financial Conduct Authority. Scotland Fund is not required to be so authorised or regulated for the activities it conducts.

No reliance. Any historical, illustrative, descriptive, or forward-looking information on the Website is provided for general informational and presentational purposes only. It is not, and must not be treated as, a representation, warranty, forecast, projection, or guarantee of any matter (including future performance, results, or outcomes). No person should rely on the Website, or any part of it, as a basis for any decision of any kind.

No relationship created. No part of the Website, and no access to or use of the Website, creates any contractual, fiduciary, advisory, agency, partnership, joint venture, or other legal relationship between Scotland Fund and any visitor. Any commercial relationship with Scotland Fund is established only through a separate, written, executed agreement.

Jurisdiction. The Website is operated from the United Kingdom and is not intended for distribution to, or use by, any person in any jurisdiction where such distribution or use would be contrary to local law or regulation, or would subject Scotland Fund to any registration, authorisation, or licensing requirement. Persons accessing the Website are responsible for informing themselves about, and observing, any such restrictions.

Independent advice. If you are in any doubt as to the meaning or effect of any information on the Website, or as to any matter relating to Scotland Fund, you should consult your own independent professional advisers before taking any action.

18. Governing Law

This Policy, and any non-contractual obligations arising out of or in connection with it, are governed by the laws of Scotland. Any disputes arising from or relating to this Policy will, where permitted by applicable law, be subject to the exclusive jurisdiction of the Scottish courts, without prejudice to your right to bring a complaint before the ICO or to seek a remedy in the courts of your habitual residence.

19. Contact Us

If you have any questions, concerns, or requests in relation to this Policy or our processing of your personal data, please contact:

Scotland Fund
Scottish Enterprise Technology Park
G75 0QU
United Kingdom
Email: legal@scotlandfund.com