Document Portal Privacy Notice

DRW Holdings, LLC and its affiliated companies, including DRW Canada Co., DRW UK Partners LLP, DRW Investments (UK) Limited, DRW Investments L.L.C., DRW Securities, LLC, DRW Singapore Pte. Ltd., DRW Commodities, LLC, DRW Global Markets Ltd., DRW Europe B.V. and DRW Europe Derivatives B.V. (collectively, “DRW”, “we”, “us”, or “our”), are committed to transparency in the collection and use of your personal information.

This notice (the “Privacy Notice”) sets out the manner in which DRW collects, uses, maintains and discloses information collected from users (each, a “User”) of the site located at https://drwholdings.sharepoint.com (the “Site”). This Privacy Notice also describes your data protection rights, including your right to object to some of the processing that DRW carries out. More information about your data protection rights and how to exercise them is set out below.

Note: When you clicked ‘accept’ on the Microsoft “review permissions” page, it was not a consent for the purposes of our lawful basis under EU or UK data protection law.

California residents, please review the California Privacy Notice for information about certain legal rights.

Collection and Use of Information

Information That You Provide: DRW may collect and use the personal information that you provide when visiting or accessing the Site. Examples of personal information that you provide and may collect include your name and email address.

Automatically-Collected Information: We may collect the IP (Internet protocol) addresses of all Users who access the Site and other related information such as page requests, browser type, operating system, average time spent on the Site and how you are using the Site. We use this information to help us understand activity on the Site (including where Users are accessing the Site from) and to monitor and improve the Site. We collect IP addresses from the platform provider for this Site.

Information Collected with Consent: When we are required to do so by law we may obtain consent to collect and use certain types of personal information (for example we may need consent for direct marketing purposes). If we ask for your consent to process this personal information you can withdraw your consent at any time by using the details at the end of this notice.

Purposes & Lawful Basis

Purpose: Where such services are offered, trading activities

Legal basis for data processing:

• Processing is necessary for the performance of a contract where we have a contract with you
• Processing is necessary for compliance with a legal obligation to which DRW is subject (under EU or EU Member State law, where EU data protection law applies)
• If we obtain your consent for the processing of personal information, the processing is permitted with your consent
• In other cases, processing is necessary for the purpose of legitimate interests pursued by DRW or others which are not overridden by the interests or fundamental rights and freedoms of affected data subjects

Purpose: Communication about services for legal and regulatory purposes

Legal basis for data processing:

• Processing is necessary for compliance with a legal obligation to which DRW is subject (under EU or EU Member State law, where EU data protection law applies)
• In other cases, processing is necessary for the purpose of legitimate interests pursued by DRW or others which are not overridden by the interests or fundamental rights and freedoms of affected data subjects

Purpose: Communication about services for servicing purposes

Legal basis for data processing:

• Processing is necessary for the performance of a contract where we have a contract with you
• In other cases, processing is necessary for the purpose of legitimate interests pursued by DRW or others which are not overridden by the interests or fundamental rights and freedoms of affected data subjects

Purpose: Managing complaints, undertaking remediation activities including to improve our services and resolving queries about us, our services and our Site

Legal basis for data processing:

• Where we need to handle a complaint or query pursuant to a contract we have with you, the processing is necessary for the performance of a contract.
• In some cases, we have legal obligations to manage complaints, remediation activities and queries in a particular manner (under EU or EU Member State law, where EU data protection law applies), so in such cases the processing is necessary for compliance with a legal obligation to which DRW is subject.
• In the case of other complaints, remediation activities to improve our services and queries, the processing is necessary for the purpose of legitimate interests pursued by DRW or others which are not overridden by the interests or fundamental rights and freedoms of affected data subjects

Purpose: If applicable, monitoring communications to check your instructions to us, analyze and improve our services and for training and quality purposes

Legal basis for data processing:

• Where we are required to carry out certain monitoring activities in order to comply with applicable law, the processing is necessary for compliance with a legal obligation to which DRW is subject (under EU or EU Member State law, where EU data protection law applies)
• In other cases, the processing is necessary for the purpose of the legitimate interests pursued by DRW or others which are not overridden by the interests or fundamental rights and freedoms of affected data subjects

Purpose: If applicable, undertaking checks for security, fraud prevention, anti-money laundering and verifying identity (both before providing services and when communicating to ensure we are dealing with the correct person)

Legal basis for data processing:

• Processing is necessary for the performance of a contract where we have a contract with you
• Where these checks are legally required (under EU or EU Member State law, where EU data protection law applies), the processing is necessary for compliance with a legal obligation to which DRW is subject
• In other cases, the processing relating to these checks is necessary for the purpose of the legitimate interests pursued by DRW or others which are not overridden by the interests or fundamental rights and freedoms of affected data subjects

Purpose: Recovering debt, enforcing other obligations as our contracts entitle us, protecting our rights and property interests and detecting, suppressing or preventing fraud

Legal basis for data processing:

• Where we are required to take these actions because we are legally required to (under EU or EU Member State law, where EU data protection law applies), the processing is necessary for compliance with a legal obligation to which DRW is subject
• In other cases, the processing is necessary for the purpose of the legitimate interests pursued by DRW or others which are not overridden by the interests or fundamental rights and freedoms of affected data subjects

Purpose: (If you ask us to and the service is offered) Providing payment initiation services for accounts you hold with other providers

Legal basis for data processing:

• Processing is necessary for the performance of a contract where we have a contract with you
• Processing is necessary for compliance with a legal obligation to which DRW is subject (under EU or EU Member State law, where EU data protection law applies)
• In other cases, the processing is necessary for the purposes of the legitimate interests pursued by DRW or others which are not overridden by the interests or fundamental rights and freedoms of affected data subjects

Purpose: Complying with regulatory and legal obligations and cooperating with regulators and law enforcement

Legal basis for data processing:

• Where we have legal or regulatory obligations, the processing is necessary for compliance with a legal obligation to which DRW is subject (under EU or EU Member State law, where EU data protection law applies)
• In other cases, the processing is necessary for the purpose of the legitimate interests pursued by DRW or others which are not overridden by the interests or fundamental rights and freedoms of affected data subjects
• For sensitive data (see below) where processing is in the public interest

Purpose: Auditing and compliance activities, including reporting obligations

Legal basis for data processing:

• Where we have legal or regulatory obligations, the processing is necessary for compliance with a legal obligation to which DRW is subject (under EU or EU Member State law, where EU data protection law applies)
• In other cases, the processing is necessary for the purpose of the legitimate interests pursued by DRW or others which are not overridden by the interests or fundamental rights and freedoms of affected data subjects

Purpose: Establishing, exercising or defending legal claims, disclosure of information in connection with legal claims, process or litigation and investigating or preventing actual or suspected loss or harm to persons or property

Legal basis for data processing:

• Where we are required to take these actions because we are legally required to (under EU or EU Member State law, where EU data protection law applies), the processing is necessary for compliance with a legal obligation to which DRW is subject
• In other cases, the processing is necessary for the purpose of the legitimate interests pursued by DRW or others which are not overridden by the interests or fundamental rights and freedoms of affected data subjects

Purpose: Preparing high-level statistical reports. We use these reports (and share these reports with third parties (on an anonymised basis)) for our own analytical purposes (including analyzing our services and how they are used so as to identify potential improvements)

Legal basis for data processing:

• Processing is necessary for compliance with a legal obligation to which DRW is subject (under EU or EU Member State law, where EU data protection law applies)
• In other cases, processing is necessary for the purpose of the legitimate interests pursued by DRW or others which are not overridden by the interests or fundamental rights and freedoms of affected data subjects:

Purpose: Site related activities, including. providing the Site and services on the Site, managing the security of the Site, running analytics in order to assess the performance of the Site, understand how users are using the Site and to improve our services and the Site)

Legal basis for data processing:

• Where we provide the Site and services on the Site pursuant to a contract with you, the processing is necessary for the performance of a contract
• Processing is necessary for compliance with a legal obligation to which DRW is subject (under EU or EU Member State law, where EU data protection law applies)
• If we obtain your consent, processing is permitted with your consent
• In other cases, the processing is necessary for the purpose of the legitimate interests pursued by DRW or others which are not overridden by the interests or fundamental rights and freedoms of affected data subjects: this includes, but is not limited to, improving and developing new website services, being more efficient and protecting our systems and networks

Purpose: Marketing communications and related processing to determine which products and services may be of interest to you

Legal basis for data processing:

• If we obtain your consent for the processing of personal information, the processing is permitted with your consent (in some cases, consent is required under law)
• Otherwise, the processing is necessary for the purpose of the legitimate interests pursued by DRW or others which are not overridden by the interests or fundamental rights and freedoms of affected data subjects

Purpose: If applicable, processing sensitive data to comply with regulatory and legal obligations and cooperate with regulators and law enforcement

Legal basis for data processing:

• Processing is in the public interest

Where UK data protection law applies, references to ‘EU or EU Member State law, where EU data protection law applies’ are references to ‘UK law’.

Note: We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above. You can obtain information on any of our balancing tests by contacting us using the details set out later in this Privacy Notice.

Where we collect personal information to administer our contract with you or to comply with our legal obligations, this is mandatory and we will not be able to provide services / the Site to you without this information. In all other cases, provision of the requested personal information is optional, but this may affect your ability to access certain functionalities on the Site, where the information is needed for those purposes.

Disclosure and Transfer of Information

We do not transfer, sell, rent, trade or otherwise disclose your personal information, except as described in this Privacy Notice. We transfer or disclose your personal information as follows:

Service Providers: Your personal information may be disclosed, stored and / or transferred (or otherwise made available) to our affiliates, including DRW Canada Co., DRW UK Partners LLP, DRW Investments (UK) Limited, DRW Investments L.L.C., DRW Securities, LLC, DRW Singapore Pte. Ltd., DRW Commodities, LLC, DRW Global Markets Ltd., DRW Europe B.V. and DRW Europe Derivatives B.V., and other third parties who provide services such as identification and background checks (where applicable), cloud-based information hosting and maintenance, website hosting, record keeping and analytics, and to exchanges, trading platforms and financial institutions (where applicable to the services).

Legal and Compliance: We and our service providers may provide your personal information in response to a search warrant or other legally valid inquiry or order, or to another organization for the purposes of investigating a breach of an agreement or contravention of law or detecting, suppressing or preventing fraud, or as otherwise required or permitted by applicable European, Canadian, Singapore, United States, or other law or legal process. Your personal information may also be disclosed where necessary for the establishment, exercise or defense of legal claims and to investigate or prevent actual or suspected loss or harm to persons or property.

Sale of Business: Your personal information may be provided to third parties in connection with a business transaction, including a merger or sale (including transfers made as part of insolvency or bankruptcy proceedings) involving all or part of DRW or as part of a corporate reorganization, or stock or asset sale, or other change in corporate control, including for the purpose of determining whether to proceed or continue with such transaction or business relationship.

International Transfer: Your personal information is stored and processed by us, our affiliates and other third-party service providers in the United States, European Union, Canada and Singapore. With respect to transfers from the European Economic Area or the UK, the transfers are to countries considered adequate by the European Commission or considered adequate as determined by applicable data protection laws or, where the transfers are to other countries, we have taken steps to provide an adequate level of protection for your personal information in accordance with EU or UK law (as applicable) by using safeguards such as EC approved Standard Contractual Clauses or, where applicable, the US Privacy Shield. You may obtain further information by contacting us using the details set out later in this Privacy Notice.

Safeguarding and Retention of Personal Information

We have implemented reasonable administrative, technical and physical measures in an effort to safeguard the personal information in our custody and control against theft, loss and unauthorized access, use, modification and disclosure. We have employed reasonable measures designed to restrict access to your personal information on a need-to-know basis to employees and authorized service providers who require access to fulfill their job requirements.

We have personal information retention processes designed to retain personal information for specified periods of time necessary for legal and business purposes.

In instances where we process your personal data, we keep this information for as long as you have access to the Site, and seven (7) years thereafter. Where we process contact information and analytics data provided by you using and visiting the Site, we do this for as long as you are an active visitor of the Site and for seven (7) years after this or as we are required by law.

Where we process personal information for marketing purposes or with your consent, we process the data until you ask us to stop and for a short period after this (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing or to process your data indefinitely so that we can respect your request in future.

Your Rights Relating to Personal Information

Where EU or UK data protection law applies and to the extent applicable under other applicable laws, you have the right to access (ask for a copy of your personal information), update, correct or delete your personal information processed by us, to restrict (stop any active) processing of your personal information processed by us, and to obtain the personal information you provide to us for a contract or with your consent in a structured, machine readable format, and to ask us to share (port) this data to another controller. You may make requests regarding these rights by emailing or writing to us at the contact information set out below. We may request certain personal information for the purposes of verifying your identity when seeking access to personal information records.

IIn addition, where EU or UK data protection law applies and to the extent applicable under other applicable laws, you can object to the processing of your personal information in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).

These rights may be limited or subject to certain exceptions prescribed by law, for example if fulfilling your request would reveal personal information about another person, or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.

Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes such as those set out above. Withdrawal of consent will not affect any processing which has already taken place at that time. In some cases, we are able to send you direct marketing without your consent, where we rely on our legitimate interests. You have an absolute right to opt-out of direct marketing, or profiling we carry out for direct marketing, at any time.

If you have unresolved concerns, where EU or UK data protection law applies to our processing, you have the right to complain to an EU or UK data protection authority where you live, work or where you believe a breach may have occurred.

Your California Privacy Rights

California residents, please review the California Privacy Notice for information about certain legal rights.

Your Nevada Privacy Rights

Nevada residents have the right to request that their personal information not be sold (as defined under applicable Nevada law), even if their personal information is not currently being sold. Requests may be sent to privacy@drw.com and are free of charge.

Third Party Websites

The Site may contain content and links to third party websites that are not owned or controlled by us. We have no control over, do not review and are not responsible for the privacy policies of or content displayed on such other websites. When you click on such a link, you will leave the Site and go to another site. During this process, another entity may collect personal information from you, and that collection is subject to the third party’s privacy policy/notice, so please refer to those third-party privacy policies/notices to understand how those parties may process your personal information.

Use by Minors Prohibited

The Site is not designed or intended for use by children under the age of 18, and we do not knowingly collect information from children. If you are under the age of 18, do not use the Site.

Updates to the Privacy Notice

We may update this Privacy Notice from time to time, including to reflect changes to our privacy practices. We will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

Contact Us

The data controller (and contact details in addition to the contact point below) in relation to your personal information is the DRW entity that you or your organisation has a contractual relationship with.

Please contact us if:

• you have any questions or comments about this Privacy Notice;
• you wish to access, update, and/or correct inaccuracies in your personal information; or
• you otherwise have a question or complaint about the manner in which we or our service providers treat your personal information.

You may contact us by email at privacy@drw.com or by mail at the following addresses:

540 West Madison Street, Suite 2500
Chicago, IL 60661

Last updated: April 14, 2020