California Privacy Notice

Effective Date: 1 April 2026

Last Updated: 18 August 2026

This California Privacy Notice (“Privacy Notice”) describes how Carrhae Capital LLP (“Carrhae”, “we” or “us”) collects, uses, discloses, and otherwise processes personal data of California residents (i.e., information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household) (“Personal Data”), and the rights you may have with respect to that Personal Data.

This Privacy Notice applies to Personal Data we collect both online and offline, including through our website at www.carrhaecap.com.

This Privacy Notice does not apply to information that we collect in the context of providing financial services, such as investment advice, which is instead described in our Privacy Notice. Please contact us at compliance@carrhaecap.com to request a copy.

We may revise and update this Privacy Notice from time to time without additional notice to you. Any changes we may make to this Privacy Notice in the future will be posted on this page, and we encourage you to check this page periodically for the most recent version of the Privacy Notice. When we update this Privacy Notice, we will revise the “Last Updated” date above. We will provide additional notification of material changes where required by applicable law.

1. Sources of Personal Data
2. Types of Personal Data We Collect
3. How We Use Personal Data
4. How We Disclose Personal Data
5. Cookies
6. Data Subject Rights
7. Data Security and Data Retention
8. Contact Information

1. Sources of Personal Data

We collect Personal Data about you from the following sources:

• Directly from you. We may collect Personal Data you provide to us directly when you access our website or otherwise interact with us.
• Data collected automatically and through Cookies. We may automatically collect information or inferences about you, such as through cookies, pixels, tags, scripts, server-side tools, and similar technologies (collectively, “Cookies”). This may include information about how you use and interact with our websites and email communications, information about your device, and internet usage information.
• From third parties. We may collect Personal Data from third parties, such as our affiliated companies and subsidiaries, business partners, and other parties who interact with us.

We may combine information that we receive from the various sources described in this Privacy Notice, including third party sources, and use or disclose the combined information for the purposes identified below.

2. Types of Personal Data We Collect

We may collect the following types of Personal Data:

• Identifiers, such as your name, email address, physical address, telephone number, business contact information, device identifiers (e.g., cookie IDs and IP address), and credentials associated with any password-protected investor or portal access made available through our website.
• Records about you, such as the content, timing and method of communications you have with us, such as online chats, calls, and emails;
• Internet or other electronic network activity information, such as your interactions with and use of our website and communications.
• Non-precise geolocation information, such as your location as derived from your IP address.
• Audio, electronic, visual, or other sensory information, such as call recordings.
• Professional or employment information, such as your employer and title.

Some of the above information may be Sensitive Personal Data, such as portal credentials when combined with the password to access your account. We use Sensitive Personal Data for legitimate business purposes, including for short-term, transient use or to (i) perform services or provide goods reasonably expected by an average person; (ii) detect security incidents; (iii) resist malicious, deceptive or illegal actions; (iv) ensure the physical safety of individuals; (v) perform or provide internal business services; and (vi) verify or maintain the quality or safety of a service or device.

3. How We Use Personal Data

We may use Personal Data for the following purposes:

• To provide you or your representatives products and services, such as making our website available to you; registering, verifying, and maintaining your account with us; communicating with you (including sending marketing communications, soliciting feedback, and responding to requests, complaints, and inquiries); or otherwise facilitating your relationship with us.
• For our internal business purposes, such as day-to-day operation of our business; maintaining internal business records, such as accounting, document management and similar activities; enforcing our policies and rules; developing and improving algorithms, artificial intelligence or machine learning tools and models; management reporting; auditing; and IT security and administration.
• For legal, safety or security reasons, such as complying with legal, reporting, and similar requirements; investigating and responding to claims against us, our personnel, and our customers; for the establishment, exercise or defense of legal claims; protecting our, your, our customers’, and other third parties’ safety, property or rights; detecting, preventing, and responding to security incidents and health and safety issues; and protecting against malicious, deceptive, fraudulent, or illegal activity.
• In connection with a corporate transaction, such as if we acquire assets of another business, or sell or transfer all or a portion of our business or assets including through a sale in connection with bankruptcy and other forms of corporate change.

We may use anonymized, de-identified, or aggregated information for any purpose permitted by law. When we collect, process, or disclose aggregated or deidentified information, we will maintain and use it in deidentified form and will not to attempt to reidentify the information, except to determine whether our deidentification processes satisfies any applicable legal requirements.

4. How We Disclose Personal Data

We may disclose Personal Data to categories of recipients described below:

• Affiliates and subsidiaries, including parent entities, corporate affiliates, subsidiaries, business units, and other companies that share common ownership.
• Service providers that work on our behalf to provide our products and services or support our relationship with you.
• Professional consultants, such as accountants, lawyers, financial advisors, and audit firms.
• Law enforcement, government agencies, and other recipients for legal, security, or safety purposes, such as when we share information to comply with law or legal requirements, to enforce or apply our Terms of Service and other agreements or policies; and to protect ours, our customers’, or third parties’ safety, property, or rights.
• Other entities in connection with a corporate transaction, such as if we acquire assets of another entity, or sell or transfer all or a portion of our business or assets including through a sale in connection with bankruptcy and other forms of corporate change.
• Entities to which you have consented to the disclosure.

Within the past 12 months, we have disclosed each of the types of Personal Data we collect, as described in the Types of Personal Data we Collect section above, for the business or commercial purposes described in the How we Use Personal Data section.

5. Cookies

As you navigate through and interact with our Services, we and our authorized third parties may use automatic data collection technologies such as Cookies to collect certain information about your equipment, browsing actions, and patterns.

We may use Google Analytics to better understand how our website is used and to improve them. To learn more about how Google Analytics collects and processes data, please visit www.google.com/policies/privacy/partners. For more information about our use of Cookies generally, please visit our Cookies Policy at www.carrhaecap.com/disclosures/cookies-policy.

We do not use any marketing or advertising Cookies on our website. As a result, our websites do not currently respond to “Do Not Track” or “Global Privacy Control” (GPC) browser settings or similar mechanisms.

6. Data Subject Rights

California residents have certain rights regarding Personal Data:

• Right to Know. You may have the right to request information about the categories of Personal Data we have collected about you, the categories of sources from which we collected the Personal Data, the purposes for collecting, selling, or sharing the Personal Data, and to whom we have disclosed your Personal Data and why. You may also have the right to request the specific pieces of Personal Data we have collected about you.
• Right to Delete. You may have the right to request that we delete Personal Data that we have collected about you.
• Right to Correct. You may have the right to request that we correct inaccurate Personal Data that we maintain about you.
• Right to Limit Use and Disclosure of Sensitive Personal Data. You may have the right to limit the use and disclosure of Sensitive Personal Data. As described above, we do not use or disclose Sensitive Personal Data in ways that would require us to provide a right to limit.

We do not “sell” or “share” Personal Data, as such terms are defined by the CCPA, including Personal Data of individuals under the age of 16.

You may submit a request to exercise your privacy rights by emailing us at compliance@carrhaecap.com. We will not discriminate or retaliate against you for exercising your privacy rights.

Verification

To process rights requests, we may need to obtain information to locate you in our records, verify your identity depending on the nature of your request, or verify that you are a resident of California and eligible to submit a privacy rights request. If we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity, and for security or fraud-prevention purposes. We may deny your request if we cannot verify your identity.

Authorized Agent

You may also designate an authorized agent to make requests on your behalf. Depending on the request, we may reach out to you directly to verify your own identity or to confirm that you provided the authorized agent with permission to submit the request, or seek additional information directly from the authorized agent to process the request.

7. Data Security and Data Retention

Although we maintain reasonable security safeguards, no security measures or communications over the Internet can be 100% secure, and we cannot guarantee the security of your information.

Your Personal Data will be retained as long as necessary to fulfill the purposes we have outlined above unless we are required to do otherwise by applicable law. This includes retaining your Personal Data to provide you with the products or services you have requested and interact with you; maintain our business relationship with you; improve our business over time; ensure the ongoing legality, safety and security of our services and relationships; or otherwise in accordance with our internal retention procedures.

8. Contact Information

If you have questions regarding this Privacy Notice, please contact us at: compliance@carrhaecap.com.