‍How the Foundation may use your personal data

The Foundation, as the data controller, may collect, store and use your personal data for purposes including the following. The processing is necessary for the performance of a contract, including:

• Administering or managing the Foundation;

• Facilitating the continuation or termination of the contractual relationship between you and the Foundation; and

• Facilitating the transfer of assets, and administering and facilitating any other transaction, between you and the Foundation.

The processing is necessary for compliance with applicable legal or regulatory obligations, including:

• Undertaking due diligence including anti-money laundering and counter-terrorist financing checks, including verifying identity and addresses (and, where applicable, in relation to beneficial owners);

• Sanctions screening and complying with applicable sanctions and embargo legislation;

• Complying with requests from regulatory, governmental, tax and law enforcement authorities;

• Surveillance and investigation activities;

• Carrying out audit checks, and instructing our auditors;

• Maintaining statutory registers; and

• Preventing and detecting fraud.

In pursuance of our legitimate interests, or those of a third party to whom your personal data are disclosed, including:

• Complying with a legal, tax, accounting or regulatory obligation to which we or the third party are subject;

• Assessing and processing requests you make;

• Investigating any complaints, or pursuing or defending any claims, proceedings or disputes;

• Providing you with, and informing you about, products and services;

• Managing our risk and operations;

• Complying with audit requirements;

• Ensuring internal compliance with our policies and procedures;

• Protecting the Foundation against fraud, breach of confidence or theft of proprietary materials;

• Seeking professional advice, including legal advice;

• Facilitating business asset transactions involving the Foundation or related entities;

• Monitoring communications to/from us (where permitted by law); and

• Protecting the security and integrity of our IT systems.

We will only process your personal data in pursuance of our legitimate interests where we have considered that the processing is necessary and, on balance, our legitimate interests are not overridden by your legitimate interests, rights or freedoms.