Privacy Policy

Ekorn | Version 3.1 | September 2026

We are committed to protecting and appropriately handling your personal data and take your privacy very seriously. This Privacy Policy explains what personal data we collect about you when you interact with us, use our website or the Ekorn platform (our "Site"), or engage with us as a client, and how we use it, who we share it with, and your rights in relation to it.

Ekorn is a trading name of Umbra Capital Partners LLP, a Limited Liability Partnership registered in England and Wales (Number OC425068), authorised and regulated by the Financial Conduct Authority (Firm Reference Number: 917090). We are the data controller in respect of your personal data (referred to as "Ekorn", "we", "us" or "our" in this notice). We are registered with the UK Information Commissioner's Office under registration number ZA550925.

Our contact details:

• Name: Ekorn
• Address: 10 Lower James Street, London, W1F 9EL
• E-mail: support@ekorn.com

Compliance team/data protection officer: If you need more information about the personal data we process, your rights, or have any concerns about your personal data or our processing, please contact us at compliance@ekorn.com .

1. Types of Personal Data We Collect

• Contact Information including your name, mailing address, email address, telephone number, and other contact details you provide when communicating with us.
• Communication Information including the contents of correspondence and communications between us by email, letter, telephone, or otherwise.
• Financial Information including information about your financial circumstances, investment objectives, risk profile, assets, income, tax status, and other information relevant to the financial services we provide.
• Identity and Verification Data including copies of identity documents, proof of address, and other information collected as part of our KYC processes.
• Client Instructions and Advice Records including records of instructions you give us, advice we provide, and the basis on which that advice is given, retained in accordance with FCA rules.
• Suitability Information including your financial objectives, investment experience, and personal circumstances relevant to suitability assessments.
• Special Category Data: In limited circumstances we may process special category data under UK GDPR Article 9, for example health information disclosed in connection with a vulnerability assessment. Special category data is excluded from AI-assisted processing.
• Technical Data including your IP address and other information your device makes available when you visit our Site.
• Usage Data including information about how you use our website and the Ekorn platform.

2. How We Use Your Personal Data

3. How and When We Disclose Personal Data

• Other parts of our organisation: We may share your data within Umbra Capital Partners LLP, including across the Ekorn and Umbra Wealth Partners trading names.
• Regulators and public authorities: We may be required to disclose your data to the FCA, HMRC, law enforcement, or courts where legally obliged.
• Professional advisers: We may share your data with lawyers, auditors, and accountants in connection with our business operations.
• Third-party service providers: We use carefully selected third-party providers bound by contractual data processing agreements.
• AI tool providers: Our approved AI tools are accessed exclusively via Amazon Web Services (AWS) Bedrock, which acts as our data processor under a formal Data Processing Agreement. All approved models are processed within the UK or EEA. AWS does not use your data to train AI models, does not share it with other customers, and does not retain it beyond the active processing session. See Section 7 for full details.
• Custodians and execution venues: We may share relevant data with our approved custodians (including Bank Julius Baer and LGT Bank) as necessary to manage your portfolio.
• Analytics and public sources: We may receive personal data from analytics providers (such as Google, outside the UK), financial advisers, or publicly available sources.

We will not sell your personal data to any third party.

4. Your Rights

• Right of Access: You have the right to request a copy of the personal data we hold about you, free of charge in most circumstances.
• Right to Rectification: You have the right to ask us to correct inaccurate or incomplete personal data.
• Right to Erasure: In certain circumstances you have the right to ask us to delete your personal data. We may be unable to comply where retention is required for legal or regulatory reasons.
• Right to Restriction: You have the right to ask us to restrict processing in certain circumstances.
• Right to Object: Where we process your data on the basis of Legitimate Interests, you have the right to object. This includes a right to object to your data being processed using AI tools. Please contact compliance@ekorn.com .
• Right to Data Portability: You have the right to receive personal data you have provided to us in a structured, machine-readable format where processing is based on consent or contract.
• Rights relating to Automated Decision-Making: We do not make solely automated decisions producing legal or significant effects without human involvement. All AI-generated outputs relating to your affairs are reviewed by a qualified member of our staff before any action is taken.
• Right to Withdraw Consent: Where we rely on consent, you may withdraw it at any time without affecting prior processing.
• Right to Complain: You have the right to lodge a complaint with the ICO at ico.org.uk or by calling 0303 123 1113. We ask that you contact us first.

To exercise any of these rights, please contact compliance@ekorn.com .

5. International Transfers of Personal Data

We may transfer your personal data outside the United Kingdom or the European Economic Area (EEA), including to countries that may not have the same level of data protection as the UK. Where we do so, we ensure appropriate safeguards are in place under UK GDPR Chapter V, including UK adequacy regulations, UK International Data Transfer Agreements (IDTAs), or the UK Addendum to EU Standard Contractual Clauses.

For example, our investment performance partner, Abaqus SpA, is based in Chile and processes customer data solely in accordance with our instructions and applicable data protection laws.

Transfers via AI tool providers: All approved AI models are accessed via Amazon Web Services (AWS) Bedrock and processed within the UK or EEA. Data does not leave the UK or EEA in connection with AI processing. The AWS Data Processing Agreement incorporating UK Standard Contractual Clauses governs all processing.

Even where your data is processed outside the UK or EEA, you retain your full rights under the UK GDPR, including the right to access, rectification, erasure, and objection. To exercise these rights, please contact compliance@ekorn.com .

6. Security

We have appropriate technical, administrative, and physical security measures in place to protect your personal data. Access is restricted to staff and service providers with a legitimate need, all subject to confidentiality obligations. We have procedures in place to deal with personal data breaches and will notify you and the ICO where legally required under UK GDPR Articles 33 and 34.

7. Our Use of Artificial Intelligence Tools

We use approved AI tools to assist with the drafting of suitability reports, client letters, and portfolio analysis documents, helping us provide you with a more efficient and consistent service.

7.1 How We Use AI

Our approved AI models are accessed exclusively via Amazon Web Services (AWS) Bedrock, a managed AI platform operated by Amazon Web Services. AWS acts as our data processor under a formal Data Processing Agreement. All approved models are processed within the UK or EEA.

We maintain an internal list of approved AI models, reviewed and signed off by our Compliance Officer and DPO. All approved models must meet the following criteria before use with client data:

• Processed within the UK or EEA via AWS Bedrock In-Region or EU geographic inference
• Governed by the AWS Data Processing Agreement
• Data does not leave the UK or EEA
• Client data is not used to train or improve the model
• Session data is not retained after processing is complete

A current list of approved models is available on request by contacting compliance@ekorn.com .

7.2 Controls Governing AI Use

• Your personal data is never used to train or improve AI models.
• AI tools do not retain your data between processing sessions.
• All AI-generated outputs are reviewed by a qualified member of our staff before any action is taken or any document is sent to you.
• AI tools are only accessed via managed systems by authorised personnel.
• Special category data, financial vulnerability information, and other sensitive personal data are excluded from AI processing.

7.3 Your Right to Object

You have the right to object to your personal data being processed using AI tools. Please contact compliance@ekorn.com and we will respond within one calendar month.

8. Cookies

Our Site uses cookies to help us understand how visitors use the website and to improve your experience. You can control cookies through your browser settings. For more information, see our Cookie Policy or visit www.allaboutcookies.org .

9. How Long We Keep Your Personal Data

We retain your personal data for as long as necessary to fulfil the purposes described in this Policy and to meet our legal and regulatory obligations. For clients, we retain records for a minimum of five years (or seven years for pension-related business) following the end of our relationship, in accordance with FCA record-keeping requirements. AI processing session data is not retained beyond the active session.

10. Special Rules for Children

Our services are directed at adults and we do not knowingly collect personal data from children under the age of 18. If you believe we have inadvertently collected personal data from a child, please contact compliance@ekorn.com and we will delete it promptly.

11. Third-Party Sites

Our Site and the Ekorn platform may contain links to third-party websites. Once you follow a link to a third-party site, this Privacy Policy no longer applies. We are not responsible for the privacy practices of third-party sites.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The current version will always be available on our website. Where changes are material, we will notify you by email or by prominent notice on our Site or the Ekorn platform. This Policy was last updated September 2026. Version 3.1. Replaces Version 3.0 (August 2026).

13. Contact Us

• By email: compliance@ekorn.com (data protection queries) or support@ekorn.com (general enquiries)
• By post: Ekorn, 10 Lower James Street, London W1F 9EL
• Ekorn is a trading name of Umbra Capital Partners LLP | FCA Registration No.: 917090 | Registered No.: OC425068 | ICO Registration No.: ZA550925