PRIVACY POLICY

1. INTRODUCTION AND SCOPE

Kameha Ventures Holding Ltd. ("Kameha Ventures," "Company," "we," "us," or "our") is committed to protecting and respecting your privacy. This Privacy Policy ("Policy") sets forth our practices concerning the collection, use, storage, transfer, and disclosure of personal information we receive from users of our website at www.kamehaventures.com (the "Website"), our services, and our business operations.

This Policy applies to all individuals whose personal information we process, including but not limited to:

• Website visitors and users
• Prospective and current portfolio companies
• Limited partners and investors
• Business partners and vendors
• Job applicants and contractors

By accessing our Website or engaging with our services, you acknowledge that you have read, understood, and agree to be bound by this Policy and consent to the processing of your personal information in accordance with its terms.

2. DEFINITIONS

For the purposes of this Policy:

• "Personal Information" or "Personal Data" means any information relating to an identified or identifiable natural person
• "Processing" means any operation performed on personal data, including collection, recording, storage, alteration, retrieval, consultation, use, disclosure, restriction, erasure, or destruction
• "Data Controller" means Kameha Ventures Holding Ltd., which determines the purposes and means of processing personal data
• "Data Subject" means the individual to whom personal data relates

3. INFORMATION WE COLLECT

3.1 Categories of Personal Information

We collect the following categories of personal information:

a) Identity and Contact Data:

• Full legal name, preferred name, and title
• Date of birth and gender
• Passport or government-issued ID information (where legally required)
• Professional email addresses and telephone numbers
• Business and residential addresses
• LinkedIn profile and professional social media accounts

b) Professional and Financial Information:

• Current and previous employment history
• Educational background and qualifications
• Professional licenses and certifications
• Investment history and preferences
• Financial statements and creditworthiness data
• Bank account details (for transactions)
• Tax identification numbers

c) Technical and Usage Data:

• Internet Protocol (IP) addresses and device identifiers
• Browser type, version, and language preferences
• Operating system and platform
• Time zone settings and location data
• Website interaction data, including pages viewed, links clicked, and navigation paths
• Marketing campaign engagement metrics

d) Communications Data:

• Records of correspondence via email, telephone, or written communications
• Meeting notes and call recordings (with consent)
• Feedback, inquiries, and support requests

3.2 Special Categories of Data

We generally do not collect special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, genetic data, biometric data, health data, or data concerning sexual orientation). If such collection becomes necessary, we will obtain explicit consent and implement enhanced protection measures.

4. METHODS OF COLLECTION

We collect personal information through:

• Direct interactions when you provide information via forms, applications, or correspondence
• Automated technologies including cookies, server logs, and analytics tools
• Third-party sources including professional databases, credit reference agencies, and publicly available sources
• Our portfolio companies and business partners (with appropriate legal basis)

5. LEGAL BASIS FOR PROCESSING

We process personal information based on the following legal grounds:

a) Contractual Necessity: Processing necessary for the performance of a contract to which you are party or to take steps at your request prior to entering into a contract

b) Legitimate Interests: Processing necessary for our legitimate interests or those of a third party, including:

• Managing and developing our business operations
• Conducting due diligence on potential investments
• Maintaining security and preventing fraud
• Marketing our services to relevant audiences

c) Legal Compliance: Processing necessary to comply with legal obligations, including:

• Anti-money laundering (AML) and Know Your Customer (KYC) requirements
• Tax reporting obligations
• Regulatory filings and disclosures
• Court orders and legal proceedings

d) Consent: Where you have given clear, informed consent for specific processing activities

e) Vital Interests: Processing necessary to protect vital interests of you or another person (rare circumstances)

6. PURPOSES OF PROCESSING

We use personal information for the following purposes:

a) Investment Activities:

• Evaluating investment opportunities and conducting due diligence
• Managing portfolio companies and monitoring investments
• Facilitating exits and distributions
• Reporting to limited partners and stakeholders

b) Business Operations:

• Managing relationships with investors, partners, and vendors
• Processing transactions and maintaining accurate records
• Conducting market research and analysis
• Improving our services and developing new offerings

c) Legal and Compliance:

• Fulfilling regulatory obligations and filings
• Conducting AML/KYC checks and sanctions screening
• Managing legal claims and disputes
• Maintaining audit trails and compliance records

d) Marketing and Communications:

• Sending newsletters, updates, and thought leadership content
• Inviting you to events and webinars
• Conducting surveys and gathering feedback
• Personalizing content based on preferences

7. DISCLOSURE OF INFORMATION

We may disclose personal information to:

a) Service Providers: Carefully selected third parties who provide services including:

• Cloud hosting and IT infrastructure
• Legal, accounting, and professional advisory services
• Marketing and communications platforms
• Background check and verification services

b) Professional Advisors: Including lawyers, bankers, auditors, and insurers

c) Regulatory Authorities: Government agencies, regulators, and law enforcement when required

d) Transaction Parties: In connection with any merger, acquisition, reorganization, or sale of assets

e) Other Parties: With your explicit consent or at your direction

All third parties are required to maintain confidentiality and implement appropriate security measures.

8. INTERNATIONAL DATA TRANSFERS

As a global investment firm, we transfer personal information across international borders. When transferring data outside your jurisdiction, we implement appropriate safeguards:

• Standard Contractual Clauses approved by relevant data protection authorities
• Adequacy decisions recognizing equivalent data protection standards
• Binding Corporate Rules for intra-group transfers
• Your explicit consent for specific transfers

We maintain records of international transfers and safeguards implemented.

9. DATA SECURITY

We implement comprehensive technical and organizational measures to protect personal information:

a) Technical Measures:

• End-to-end encryption for data in transit and at rest
• Multi-factor authentication and access controls
• Regular security assessments and penetration testing
• Intrusion detection and prevention systems
• Secure backup and disaster recovery procedures

b) Organizational Measures:

• Data protection policies and procedures
• Regular employee training on data security
• Confidentiality agreements with all personnel
• Incident response and breach notification procedures
• Privacy by design and default principles

10. DATA RETENTION

We retain personal information for the duration necessary to fulfill the purposes outlined in this Policy, unless a longer retention period is required by law. Our retention schedule considers:

• Contractual obligations and business relationships
• Legal limitation periods (typically 6-10 years)
• Regulatory requirements for financial services
• Tax and accounting obligations
• Litigation holds and legal proceedings

Upon expiration of applicable retention periods, we securely delete or anonymize personal information.

11. YOUR RIGHTS

Subject to applicable law, you have the following rights:

a) Access: Obtain confirmation of whether we process your personal data and request copies

b) Rectification: Correct inaccurate or incomplete personal information

c) Erasure ("Right to be Forgotten"): Request deletion of personal information in certain circumstances

d) Restriction: Limit processing of personal information in specific situations

e) Data Portability: Receive personal data in a structured, commonly used format

f) Objection: Object to processing based on legitimate interests or direct marketing

g) Automated Decision-Making: Not be subject to solely automated decisions with legal effects

h) Withdraw Consent: Where processing is based on consent, withdraw it at any time

To exercise these rights, contact our Data Protection Officer using the details in Section 16.

12. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies to enhance functionality and analyze usage. Categories include:

• Strictly Necessary Cookies: Essential for Website operation
• Performance Cookies: Analyze Website performance and usage
• Functionality Cookies: Remember preferences and settings
• Targeting Cookies: Deliver relevant content and measure effectiveness

For detailed information, please refer to our separate Cookie Policy.

13. THIRD-PARTY LINKS AND SERVICES

Our Website may contain links to third-party websites and services. We are not responsible for their privacy practices. We encourage you to review their privacy policies before providing personal information.

14. CHILDREN'S PRIVACY

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from minors. If we become aware of such collection, we will promptly delete the information.

15. CHANGES TO THIS POLICY

We may update this Policy periodically to reflect changes in our practices, technologies, legal requirements, or business operations. Material changes will be communicated through:

• Prominent notice on our Website
• Direct communication to registered users
• Updated "Last Updated" date

Continued use of our services after changes constitutes acceptance of the revised Policy.

16. CONTACT INFORMATION AND DATA PROTECTION OFFICER

For questions, concerns, or to exercise your rights, contact:

17. COMPLAINTS

If you believe we have not addressed your concerns adequately, you have the right to lodge a complaint with your local data protection authority. We would appreciate the opportunity to address your concerns before you approach the regulator.

18. GOVERNING LAW AND JURISDICTION

This Policy is governed by the laws of the United Arab Emirates. Any disputes shall be subject to the exclusive jurisdiction of the Dubai International Financial Centre (DIFC) Courts.