Privacy & Confidentiality Policy

This Privacy & Cookies Statement describes how KNM Advisory LLC and its affiliates collect, use, share, and otherwise process Personal Data (defined below). The controller of your Personal Data is the KNM Advisory entity with which you engage (the "Firm"). The Firm processes personal data about:

• Visitors to our websites, mobile applications, and other online properties (each, a "Site");
• Contact persons for our clients and/or prospective clients;
• Contact persons for suppliers of goods and services to the Firm;
• Any other individuals about whom the Firm obtains Personal Data.

In this Privacy & Cookies Statement, "Personal Data" means information that (either in isolation or in combination with other information held by the Firm) enables you to be identified as an individual or recognized directly or indirectly.

If you provide us with Personal Data relating to other persons (such as family members, work colleagues, employees, etc.), you are responsible for ensuring the relevant individuals are made aware of the terms of this Privacy & Cookies Statement and that you are legally entitled to provide us with their Personal Data. You are also responsible for ensuring that their Personal Data is accurate and up-to-date.

Overview

Unless we specifically state otherwise, the Firm is the controller of the Personal Data we process, and is therefore responsible for ensuring that the systems and processes we use are compliant with the Law of Georgia on Personal Data Protection ("PDP").

Firm personnel are required to comply with this Privacy & Cookies Statement and associated Firm policies when dealing with Personal Data and must also complete data protection training where appropriate to their role.

Collection of Personal Data

We collect the following categories of Personal Data about Site visitors, clients, prospective clients, suppliers and other third parties:

• Basic data: Name, gender, title, organization, job responsibilities, phone number, mailing address, email address, contact details and information about family life (excluding special categories of data) including family, children, hobbies and interests.
• Special categories of data: In limited circumstances, where you have provided us with such information as it is necessary for a specific service we are providing to you: religious or other beliefs, racial or ethnic origin, sexual orientation, health data and details of trade union membership.
• Registration data: Newsletter requests, event/seminar registrations, dietary preferences (excluding special categories of data), subscriptions, downloads, and username/passwords.
• Client service data: Personal Data received from clients in respect of employees, customers or other individuals known to clients, invoicing details and payment history, and client feedback.
• Marketing data: Data about individual participation in conferences and in-person seminars, credentials, associations, product interests, and preferences.
• Transaction data: Personal data contained in documents, correspondence or other materials provided by or relating to transactions, proceedings or other legal matters on which we are advising our clients.
• Interaction data: Personal data such as contact data, e-mail metadata and other technical data relating to your interactions with us.
• Compliance data: Government identifiers, passports or other identification documents, dates of birth, beneficial ownership data, and due diligence data.
• Job applicant data: Data provided by job applicants or others on our Sites or offline means in connection with employment opportunities.
• Device data: Computer Internet Protocol (IP) address, unique device identifier (UDID), cookies and other data linked to a device, and data about usage of our Sites (Usage Data).
• CCTV data: Images captured through the use of CCTV in Firm offices (where applicable) for routine security monitoring purposes.

We collect Personal Data from a number of sources, either directly from the data subjects, or from clients, colleagues and publicly available sources. Where the Firm receives data from its clients about employees, customers or other individuals, the client is responsible for ensuring that any such data is transferred to us in compliance with applicable data protection laws.

Use of Personal Data

The purposes for which we use Personal Data, and the legal bases for such processing, are as follows:

• To provide legal advice and respond to inquiries: We use basic data, registration data, client service data, and device data. We need to process your information in this way in order to perform our obligations under our contracts with our clients.
• To manage our business operations and administer our client relationships: We use basic data, special categories of data, registration data, marketing data and client service data. This processing is necessary in order to perform our obligations under our contracts with our clients (e.g. issuing and processing invoices) and suppliers (e.g. managing the supply of goods and services to the Firm).
• To make our Sites more intuitive and easy to use: We use device data. It is necessary for our legitimate interests to monitor how our Sites are used to help us improve the layout and information available on our Sites and provide a better service to our Site users. Where this involves Google Analytics, we rely on your consent instead, as described under Cookies.
• To protect the security and effective functioning of our Sites and information technology systems: We use basic data, registration data, transaction data, and device data. It is necessary for our legitimate interests to monitor how our Sites are used to detect and prevent fraud, other crimes and the misuse of our Sites.
• To expand and maintain our list of contacts: We use basic data, interaction data and device data. It is necessary for our legitimate interests to keep your information accurate and up-to-date with the aim of improving the overall client experience and our relationship with you.
• To provide relevant marketing: We use marketing data, basic data, special categories of data, registration data, client service data, and device data. It is necessary for our legitimate interests to process this information in order to provide you with tailored and relevant marketing, updates and invitations.
• To address compliance and legal obligations: Such as complying with the Firm's tax reporting obligations, checking the identity of new clients and to prevent money laundering and/or fraud we use compliance data, basic data, registration data, transaction data, and device data.
• To consider individuals for employment and contractor opportunities: We use job applicant data and compliance data.
• For routine security monitoring purposes: In relevant offices, we use basic data and CCTV data.

Use of Artificial Intelligence

The Firm may use Artificial Intelligence ("AI") technology to support the processing of Personal Data for the purposes referred to in this Privacy & Cookies Statement. All such AI technology is subject to robust prior screening to ensure that it meets applicable ethical, legal and contractual requirements including in respect of data privacy and information security. The use of AI technology to make decisions affecting individuals by solely automated means (including in a recruitment context) is strictly prohibited.

Sharing of Personal Data

We may share Personal Data with the following categories of recipients:

• Affiliates: KNM Advisory LLC may share Personal Data with its affiliates in order to provide you with legal services and in order to administer our relationship with you.
• Suppliers and service providers: We share Personal Data with suppliers and service providers to enable such parties to perform functions on our behalf and under our instructions. These include infrastructure and IT services providers, third party consultants, and event venues.
• Financial institutions: We share Personal Data with financial institutions in connection with invoicing and payments.
• Corporate purchasers: We may share Personal Data with any corporate purchaser or prospect to the extent permitted by law as part of any merger, acquisition, or sale of Firm assets.
• Mandatory disclosures and legal claims: We share Personal Data in order to comply with the Firm's tax reporting obligations, comply with any subpoena, court order or other legal process, or to comply with a request from our regulators.

Marketing Choices

You have control regarding our use of Personal Data for direct marketing. In certain markets, you will need to expressly consent before receiving marketing and the location you select when you submit your contact details may impact the rules which apply. In all markets, you can choose to not receive such communications at any time. If you no longer wish to receive any marketing communications, you can do so by clicking on the “Unsubscribe” link in any marketing email communications you receive.

Cookies

We use and engage certain providers to use cookies, web beacons, and similar tracking technologies (collectively, "cookies") on our Sites.

What are cookies?

Cookies are small amounts of data that are stored on your browser, device, or the page you are viewing. Some cookies are deleted once you close your browser, while other cookies are retained even after you close your browser so that you can be recognized when you return to a website.

How do we use cookies?

Cookies on our Sites are generally divided into the following categories:

• Necessary Cookies: These cookies are necessary for the website to function and cannot be switched off in our systems.
• Functional Cookies: These cookies enable the website to provide enhanced functionality and personalisation.
• Performance Cookies: These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site.
• Targeting Cookies: These cookies may be set through our site by our advertising partners to build a profile of your interests.
• Social Media Cookies: These cookies are set by a range of social media services that we have added to the site to enable you to share our content.

Google Analytics

We use Google Analytics, a web analytics service provided by Google, on our Sites, but only if you allow analytics cookies in our cookie banner. It helps us count visits and traffic sources and understand how our Sites are used, so that we can improve them. If you accept, it sets Performance Cookies in your browser: _ga and _ga_NB2J2EYYNR, each lasting up to two years.

Through these cookies, Google Analytics collects device data such as the pages you view, the page you came from, your browser and device type, and your approximate location. Google states that Google Analytics does not log or store IP addresses. We process this data on the basis of your consent, and we keep it in Google Analytics for up to 14 months. Google may process it outside Georgia, including in the United States.

You can change your choice at any time in Cookie Settings at the bottom of our pages, where each type of cookie has its own switch. If you switch analytics cookies off, we remove them from your browser. We keep your choice in your browser's local storage so that we do not have to ask again. You can also block these cookies in your browser settings or install the Google Analytics Opt-out Browser Add-on. For more information, see How Google uses information from sites or apps that use our services.

Data Subject Rights

Under the Law of Georgia on Personal Data Protection ("PDP"), you have the following rights:

• Access: You have the right to request a copy of the Personal Data we are processing about you.
• Rectification: You have the right to require that any incomplete or inaccurate Personal Data that we process about you is amended.
• Deletion, Destruction or Blocking: You have the right to request that we delete, destroy or block Personal Data that we process about you, if the data is no longer necessary for the purpose for which it was collected, or if processing is unlawful.
• Withdrawal of Consent: If you have consented to our processing of your Personal Data, you have the right to withdraw your consent at any time, free of charge.
• Objection: Where the legal justification for our processing of your Personal Data is our legitimate interest, you have the right to object to such processing on grounds relating to your particular situation.

You also have the right to lodge a complaint with the State Audit Office of Georgia if you believe that we have not complied with applicable data protection laws.

Data Security

We have implemented technical and organisational measures in an effort to safeguard the Personal Data in our custody and control. Such measures include restricting access to Personal Data to staff and service providers on a need-to-know basis and utilizing internal security policies to protect our internal Firm and client data.

While we endeavour to always protect our systems, sites, operations and information against unauthorized access, use, modification and disclosure, due to the inherent nature of the Internet, we cannot guarantee that any information, during transmission or while stored on our systems, will be absolutely safe from intrusion by others.

Cross-Border Data Transfers

We generally process Personal Data within Georgia. We typically do not engage in Cross-Border Data Transfers as a routine practice. However, some of the online services behind our Sites process data outside Georgia, including in the United States. Google Analytics, described under Cookies above, is one of them.

In client matters, we may transfer Personal Data to foreign jurisdictions only for clients who need representation outside of Georgia and who specifically ask us to, hire us for, and/or give us consent to share data within Cross-Border Data Transfers. In such cases, we ensure that such transfers comply with the requirements of the Law of Georgia on Personal Data Protection.

Other Issues

• What are the consequences of not providing Personal Data? You are not required to provide all Personal Data, but certain functionality will not be available if you do not.
• Do we engage in automated decision-making? We do not use automated decision-making without human intervention, including profiling, in a way that produces legal effects concerning you.
• How long do we retain Personal Data? We typically retain Personal Data related to marketing activities for as long as you accept marketing communications from us. For other purposes, we retain data for as long as necessary to fulfill the purposes outlined in this statement.
• Are third party websites governed by this Privacy & Cookies Statement? The Sites may contain links to other websites. This Privacy & Cookies Statement does not apply to such third party sites.

Contact Us

If you have questions or comments regarding this Privacy & Cookies Statement or our privacy practices, please contact us here: