Privacy Policy.

1. Introduction

Fundflow Technologies Pte. Ltd. (UEN: 202614635N), a private company limited by shares incorporated in Singapore ("we," "our," or "us"), is committed to protecting the privacy and security of your information. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use Drawden, our portfolio reporting and analytics platform for limited partners (the "Service").

This policy is designed in accordance with the Personal Data Protection Act 2012 of Singapore ("PDPA") and other applicable data protection laws. It explains our processing; it does not replace a client's signed data-protection agreement or seek blanket consent to processing.

Our two roles

When we act for our clients. Personal data in documents and data uploaded or connected by a client, including information about investors or beneficial owners, is processed on that client's behalf under its instructions and our contract. We act as a processor or data intermediary for that processing. Please direct requests about a client's records to that organization; we assist it in responding as our contract and applicable law require.

When we act for ourselves. For account administration, billing, website and usage information that we process for our own business purposes, we are the organization responsible under the PDPA, or the controller where that concept applies. This policy applies directly to that processing. We do not treat uploaded client documents as our own data merely because they pass through Drawden.

2. Information We Collect

2.1 Information You Provide

• Account information (name, email address, organization name)
• Fund data and financial information you input into the platform
• Documents you upload (capital account statements, notices, quarterly reports)
• Communications with our support team
• Payment and billing information

2.2 Information Collected Automatically

• Log data (IP address, browser type, access times)
• Device information (hardware model, operating system)
• Usage data (features used, actions taken within the platform)
• Cookies and similar tracking technologies

3. How We Use Your Information

We use information for the following purposes, subject to the roles above. Client data is processed only to deliver the contracted services on the client's instructions, not for unrelated purposes:

• Provide, maintain, and improve our Service
• Process and extract data from uploaded financial documents using AI-powered analysis
• Process transactions and send related information
• Send technical notices, updates, and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze trends, usage, and activities
• Detect, investigate, and prevent fraudulent transactions and abuse
• Comply with legal obligations

4. AI-Powered Document Processing

Our Service uses artificial intelligence to extract and analyze data from financial documents you upload. Document content may be processed by authorised AI providers for extraction, classification and enabled VDR automation. The applicable providers are identified in our private sub-processor register. Processing is limited to the enabled service and the client's instructions. We do not use client financial data to train our own general-purpose AI models. Provider retention depends on the commercial service, account settings and applicable legal or security requirements; we do not promise that every AI request has zero retention. The applicable client agreement governs supplier use and data protection.

5. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Organization-level data isolation with Row Level Security (RLS)
• Dependency scanning and security review processes
• Access controls and multi-factor authentication mechanisms
• Managed cloud infrastructure with supplier assurance information available for review

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain client service data for the relevant services and provide a 30-day export window after termination. Within the following 30 days, no later than 60 days after termination, we delete remaining client data and copies, including backups, or irreversibly anonymise data where authorised, unless applicable law requires retention. For personal data processed on a client's behalf, the client chooses return or deletion; anonymisation does not replace that choice. We provide deletion certification on written request and revoke or disable third-party access tokens for terminated services immediately. Data still required for other active services remains protected under the contract.

Data retained because law requires it is isolated, protected and used only for that purpose, then deleted when the requirement ends. Our own account, billing and business records are retained only for as long as needed for their lawful business or legal purposes. A separate signed agreement governs its client data where it specifies different requirements; this policy does not amend it.

7. Data Sharing

We do not sell your personal information. We may share your information only in the following circumstances:

• Service Providers: With third-party vendors who assist in operating our Service (e.g., cloud hosting, AI document processing), subject to confidentiality obligations
• Legal Requirements: When required by law, regulation, or to respond to legal process
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you have given us explicit permission

We maintain a private register of sub-processors used to operate Drawden, including their roles and relevant processing locations. Clients receive the applicable register as part of the authorisation process and may request an up-to-date copy at any time. Under our data-protection agreements, we provide at least 30 days' advance email notice of additions or replacements affecting client personal data, together with information needed to assess the change and exercise contractual objection rights. Updating the register alone does not replace that notice.

8. Your Rights

Depending on the law that applies to you and its conditions and exceptions, you may have the following rights regarding your personal data:

• Access and receive a copy of your personal data
• Correct inaccurate or incomplete personal data
• Request deletion of your personal data
• Restrict or object to processing of your personal data
• Data portability where the applicable law provides it
• Withdraw consent where processing relies on consent, without affecting prior lawful processing

Not all of these rights arise under the PDPA. If UK GDPR or EU GDPR applies to your data, you have the rights granted by those laws, including the right to complain to the relevant supervisory authority. You may also raise a PDPA concern with Singapore's Personal Data Protection Commission. Contact marcel@drawden.com to exercise applicable rights; for client-controlled records, contact the client as explained above.

9. International Data Transfers

We are incorporated in Singapore and use cloud and service providers in other countries. Overseas support access can also be a transfer, even where primary storage is in the UK or EU. Applicable safeguards must provide protection required by the relevant law, including comparable protection for PDPA transfers and an appropriate transfer mechanism for restricted UK/EU transfers. Our client data-protection agreements record the applicable mechanisms and assessments. Contact marcel@drawden.com for information about the safeguards relevant to your data.

10. Cookies

We use essential cookies to maintain your session and ensure the Service functions correctly. We do not use third-party advertising or tracking cookies. You can control cookie settings through your browser preferences, though disabling essential cookies may affect the functionality of the Service.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically for any changes.

12. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us at: