Identification Identification
Private zone Private zone

Data
processor

Nter

IN THIS SECTION OF THE PRIVACY POLICY, WE INFORM YOU HOW THE COMPANY, AS A DATA CONTROLLER, PROCESSES YOUR PERSONAL DATA.

1. In whose name does the Company operate?

During the preparation of this Privacy Policy, the Company, as a data controller, operates on behalf of the following data controllers:

a) Closed-end investment company for informed investors ORION Healthcare and Wellness Fund, legal entity code 304143422, registered address: Antano Tumėno g. 4, Vilnius; b) Open-end investment company OMX Baltic Benchmark Fund, legal entity code 111713358, registered address: Antano Tumėno g. 4, Vilnius.

Further in this section of the Privacy Policy, the closed-end investment company for informed investors ORION Healthcare and Wellness Fund and the open-end investment company OMX Baltic Benchmark Fund are collectively referred to as investment companies.

2. What processing of personal data has been entrusted to the Company?

2.1 Scope of personal data, purposes, and other information regarding the processing of personal data:

The management of investment companies, as collective investment undertakings, has been entrusted to the Company. Considering this, the investment companies' rights and obligations in the field of personal data processing specified in Section 1 of this Privacy Policy are implemented through the Company. This means that the Company processes all personal data on their behalf and carries out all actions related to the processing of personal data.

For detailed information about the processing of personal data carried out on behalf of the closed-end investment company for informed investors ORION Healthcare and Wellness Fund, you can familiarise yourself here.

Detailed information on the processing of personal data on behalf of the investment company OMX Baltic Benchmark Fund is available here.

2.2 Data transfer to third countries

When processing personal data on behalf of investment companies, we use Microsoft products and services and have entered into a Data Processing Agreement with Microsoft Ireland Operations Limited, established in Ireland. In the course of the provision of services by this processor, there may be cases where data is transferred to third countries, in which case the Standard Data Protection Clauses (Data Processor-Auxiliary Processor Module) agreed between Microsoft Ireland Operations Limited and Microsoft Corporation (https://www.microsoft.com/licensing/docs/view/Professional-Services-Data-Protection-Addendum-DPA) will apply to the protection of your personal data. These clauses are intended for the transfer of personal data from data processors in the European Economic Area to subprocessors located in third countries where an adequate level of personal data protection is not ensured, as described in Article 46 of the GDPR and confirmed in the decision 2021/914/EU of the European Commission adopted on 4 June 2021. Please note that the United States, where "Microsoft Corporation" is located, has been recognised by the European Commission as ensuring an adequate level of protection.

2.3 Data Collection and Disclosure

Your personal data recipients also include our appointed subprocessors, who are subject to the same obligations as us, as data controllers.

The list of recipients or categories of recipients specified in the Privacy Policy may change, so if you wish to be informed about changes to the recipients of your personal data, please notify us by email at dpo@nteram.lt, indicating "I wish to receive information about changes to the recipients of my personal data, name, surname" in the subject line.

3. What rights do you have?

In this section, we provide information about your rights related to the processing of your personal data carried out on behalf of the investment companies and cases where you can exercise these rights.

Please note that we handle data subjects' requests and responses to them. If you want to obtain more information about your rights or exercise them, please contact us by email at: dpo@nteram.lt.

We will provide you with information about the actions taken upon receiving your request regarding the implementation of your rights within 1 (one) month from the receipt of the request, without undue delay. Depending on the complexity of the request and the number of requests received, this period may be extended for an additional 2 (two) months. In such a case, we will inform you within 1 (one) month of receiving the request about the extension of the term and its reasons. We will refuse to implement your rights only in cases provided by law.

3.1 Right of access to own personal data

We aim for you to fully understand how the investment companies specified in this section of the Privacy Policy process your personal data and to ensure that you do not experience any inconvenience as a result. We primarily provide information on how we process your personal data in this section of the Privacy Policy. However, you can always contact us to inquire whether we process any of your personal data on behalf of the investment companies. If we store or use any of your personal data on behalf of the investment companies, you have the right to access them. To do so, please submit a written request to us at the email address: dpo@nteram.lt, and confirm your identity (if such confirmation is required in specific cases).

We expect that in making such requests, you will not abuse the process and will adhere to principles of fairness and reasonableness.

3.2 Right to withdraw your consent

If you have provided clear consent to the investment companies for the processing of your data, you can revoke it at any time. Withdrawal of consent does not affect the lawfulness of data processing based on consent before its withdrawal.

3.3 Accessory rights

Below you will find information about additional rights that you may have, which you can exercise by following the procedures described below.

  • You have the right to ask us to correct any inaccuracies in the data we hold. In this case, we may ask you to confirm the corrected information.
  • You have the right to ask us to delete your personal data. This right is exercised in cases provided for in Article 17 of the General Data Protection Regulation (EU) 2016/679.
  • You have the right to request us to restrict or not process your personal data:
  • During the period of time necessary to verify the accuracy of your personal data when you make a complaint about the accuracy of the data;
  • where our collection, storage or use of your personal data is unlawful, but you choose not to request erasure of the data;
  • where we no longer need your personal data, but you need it to establish, exercise or defend a legal claim;
  • the period necessary to determine whether we have an overriding legal basis to continue processing your personal data if you have exercised your right to object to the processing of personal data.
  • You have the right to receive your data, processed by automated means and provided by you in a structured, commonly used, and machine-readable format, with your consent or for the purpose of entering into a contract. Upon your request, we will transfer a copy of your data provided by you to you or to a data controller of your choice.
  • You have the right, in accordance with Article 21 of the GDPR, to object to the processing of your personal data, for example, when we use your personal data based on our legitimate interests.

3.4 Right to request more information

We endeavour to provide as clear and comprehensive information as possible about the processing of personal data by investment firms and undertake to update this part of the Privacy Policy in the event of any changes in the process of using personal data. However, if you have any questions about our use of your personal data, we will be happy to answer them or provide you with any additional information we may disclose. If you have any specific questions or if you do not understand the information provided, please contact us.

4. Complaints

If you believe that your rights as a data subject are or may be infringed, please do not hesitate to contact us by email: dpo@nteram.lt. We assure you that upon receipt of your complaint, we will contact you within a reasonable period and inform you about the progress of the investigation, and later about the outcome.

If you are dissatisfied with the results of the investigation, you may lodge a complaint with the supervisory authority – the State Data Protection Inspectorate https://vdai.lrv.lt/