Privacy Policy & Data Protection Notice

1. Introduction & Scope

Real Estate Growth Capital by Ascend ("AREV", "Ascend", "we", "us", or "our") is a specialist investment firm headquartered in Singapore. This Privacy Policy sets out how we collect, use, store, disclose, and protect personal data collected through the AREV Investor Portal ("the Platform").

We manage personal data in accordance with the Singapore Personal Data Protection Act 2012 (PDPA) and the India Digital Personal Data Protection Act 2023 (DPDP Act) for all investors and institutional stakeholders.

2. Personal Data We Collect

We only collect personal data reasonably necessary to provision your investor account, secure institutional communication, and provide Deal Room access. This includes:

• Identity & Profile Data: Full name, company affiliation, job title, and optional profile photograph.
• Contact Information: Corporate email address and telephone number.
• Legal Nominee Details (DPDP Act Sec 14): Nominee name, relationship, and contact email or telephone.
• Security & Authentication Data: Password hashes, session tokens, multi-factor authentication factors, and role permissions.
• System & Access Logs: IP address, browser user-agent, timestamps of login, and Deal Room document access records.
• Consent Records: Proof of affirmative consent, policy version, and timestamp of acceptance.

3. Purposes of Collection, Use, and Disclosure

We collect and process your personal data for the following specific purposes:

• Provisioning and managing your authenticated access to assigned investment projects.
• Distributing periodic investor performance updates, quarterly reports, and key performance indicators (KPIs).
• Granting secure access to view and download confidential Deal Room documents (IC memos, audited financials, project plans).
• Enforcing security controls, detecting unauthorized access, and maintaining immutable forensic audit trails.
• Complying with statutory anti-money laundering (AML), counter-terrorist financing (CFT), and cross-border regulatory obligations.

4. Consent, Withdrawal, and Grievance Redressal

By accessing the portal, completing invitation onboarding, or checking the consent agreement, you consent to the collection, use, and disclosure of your personal data as outlined in this Notice.

Under Section 6(4) of the DPDP Act and Section 16 of the Singapore PDPA, you may withdraw your consent at any time by giving written notice to our Data Protection & Grievance Officer at dpo@regca.com. Withdrawing consent will terminate access to confidential Deal Room assets upon confirmation.

5. Your Rights & Data Portability

Under the Singapore PDPA and DPDP Act 2023, data principals enjoy statutory rights to access, correction, erasure, data portability, and nominee registration:

• Request Access: Obtain a copy of your personal data in our custody and information on how it has been processed.
• Request Correction: Request the immediate correction of inaccurate or incomplete personal records.
• Data Portability (Task PRIV-01): Download your complete personal data package (JSON) directly from your investor profile.
• Right of Nomination (Sec 14 DPDP Act): Nominate a designated representative to exercise data rights in the event of death or incapacity.
• Grievance Redressal: File a grievance with our Grievance Officer, with escalation rights to the Data Protection Board of India under Section 13.

6. Protection & Security Safeguards

We maintain reasonable security safeguards to protect personal data from unauthorized access, breach, copying, or alteration:

• Enforcing strict Transport Layer Security (TLS 1.3) and HTTP Strict Transport Security (HSTS) across all endpoints.
• Cryptographic Content Security Policy (CSP) with per-request nonces.
• Database Row Level Security (RLS) with immutable append-only audit logging.
• Short-lived signed URLs for document access, ensuring Deal Room files are never exposed through permanent public URLs.
• Enforcing strong password standards and multi-factor authentication for administrative users.