Harbor Group Management Company's Privacy Policy

Harbor Group Management Company Privacy Policy

February 2026

Introduction

This Privacy Notice (“Notice”) is provided to inform you about how Harbor Group International, LLC (“HGI”), Harbor Group Management Co., LLC (“HGMC”), and our affiliates (collectively referred to as “we”, or “our”) process the personal information that we collect in online and offline formats through our Services. When we use the term “Services,” we mean to refer collectively to:

• The provision of investment and other services during the operation of our business (“Investment Services”);

• The provision of rental and other services during the operation of our business (“Rental Services”)

• The websites and mobile applications, if any, owned and controlled by us that link to this Notice (“Sites”); and

• Our marketing and business development activities, including events we host, social media sites we operate, and emails that we send (“Marketing Activities”).

In connection with our Services, we receive personal information from:

• Current, prospective and former investors of HGI funds or other HGI-managed vehicles (“Investors”);

• Current, prospective and former renters of HGMC or HGMC-managed properties (“Renters and Visitors”); and

• Other business contacts (“Other Business Contacts”), including:

○ Visitors to our offices, events, Sites and users of any digital Services we provide;

○ Individual representatives of third-party sellers, placement agents, finders, investment bankers, consultants, lawyers, accountants, advisers and other service providers and vendors, whether or not engaged by HGI, HGMC or our affiliates; and

○ Directors, officers, employees, representatives and other individuals associated with the assets in which HGI has made an investment or is considering making an investment.

This Notice explains the data, including personal information we collect about you, how we collect it, with whom we share it, how we protect your data and privacy, your rights regarding the collected data, and how to contact us regarding this Notice or to exercise your personal information rights. This Notice does not apply to information we collect from our employees, contractors, or applicants for employment. Important information for current and former investors about how we collect, use, and share your nonpublic personal information, as well as your ability to opt- out of certain sharing can be found in Section 12.

By using our Sites or providing personal information to us in connection with our Services, you acknowledge that you have read, understood, and agree to the practices described in this Notice.

This Notice is incorporated into and subject to our Terms of Use.

We reserve the right to update this Notice periodically and without prior notice to you to reflect changes in our personal information practices. We encourage you to periodically review this Notice to stay informed about our information practices and the choices available to you. If we make changes, we will post the updated Notice version on our Sites and indicate at the top of the Notice the date it was most recently updated. If we make material changes, we will provide you with additional notice (such as by adding a statement to the Services or sending you a notification).

1. Personal Information Sources and Types Collected

We use the term “personal information” to mean data that reasonably can be used to identify a living person, or that reasonably relates to a living person.

The types of personal information we collect and share depend on your relationship with us. In connection with all of our Services, within the past 12 months, we have collected information from the following groups:

Investors:

We collect the following categories of personal information:

• Contact information (including name, address, email, telephone number);

• Other identification information (including signature, date of birth, social security number, taxpayer identification number, driver’s license, passport, other government identification and numbers);

• Financial information (including assets, income, net worth, amounts and types of investments, capital account balances, capital commitments, capital contributions, account data, other investment participation information, funds transfer information, beneficiaries, positions, percentages of fund, share or option numbers and values, vesting information, investment history, transaction information, tax information);

• Background information (including information revealed in know-your-customer (KYC) and anti-money laundering (AML) due diligence, investor accreditation and consents;

• Sensitive information (as defined by applicable data protection laws) (including specific subset of personal information that includes certain government identifiers (such as social security numbers), age, marital status, or citizenship; and

• Sensory information (including audio recordings of phone calls).We collect this personal information from:

• Forms you complete, such as subscription agreements, investor questionnaires, online contact forms, applications or other forms;

• Your correspondences (written, telephonic, voicemails or electronic);

• Your transactions with us or others;

• Third party service providers (e.g., background screening, investor placement, or public databases) who perform services on our behalf or verify or supplement our information; and

• Information you give to any of our Sites, including registration information and information captured via cookies.

We collect this personal information for the purposes of and pursuant to the legal bases of contract performance, legal compliance, and legitimate interests. These include:

• Complying with legal or regulatory obligations, such as our obligations regarding know your-client and anti-money laundering, as well as for tax purposes;

• Performing a contract with you or to take steps at your request before entering into a contract, including to: (i) provide you with information regarding our services, (ii) assist you and answer your requests, (iii) evaluate whether we can offer you a service and under what conditions;

• Other legitimate business interests, such as:

○ For our everyday business purposes – such as to process your transactions, maintain or service your account(s), communicate with you, pay funds, manage records, respond to court orders and legal investigations, and administer and provide services to you, including onboarding, marketing, research and due diligence;

○ For our marketing purposes – to offer our services to you, provide newsletters or other information that we believe may be of interest to you, to improve and customize our services for you and to understand how our services are used; and

○ For our risk mitigation purposes – to protect against fraud and security risks, including through background screening.

○ In some cases, we rely on your consent for processing your personal information, but only in those cases where we specifically ask for your consent.

Renters and Visitors:

We collect the following categories of personal information:

• Contact information (including postal address and e-mail address, phone number);

• Other identification information (name, birthdate, governmental identification numbers, Social Security number, gender);

• Family information (including number of children, family member names and contact details);

• Tax status information (including tax ID, tax residence);

• Professional and employment information (including employment history, income, resume details, personnel files, pay and benefits information);

• Financial information (including bank account details, credit history and reports);

• Account information (including username and password);

• Service-related information (including requests you make in connection with our Services);

• Other background information (including information on criminal history/unlawful conduct);

• Health information (including dietary restrictions or disabilities);

• Electronic identifying information (including IP address, Site activities, the Internet address you came from or go to, browser information, internet service provider information, date and timestamp information, clickstream information);

• Sensitive information (as defined by applicable data protection laws) (including specific subset of personal information that includes certain government identifiers (such as social security numbers), age, marital status, citizenship, precise geolocation, or information of a known child (with the consent of a parent or guardian, for purposes of tenant applications only); and

• Biometric information (including fingerprints and facial scans).

We collect this personal information from:

I. Information you provide to us

In order for you to access certain Services, we may require you to provide us with certain personal information. We may also collect information you provide to us in any communication between us, including phone calls, online form responses, tenant applications, and emails, which we may use to fulfill your requests and to improve our services. On some of our Sites, you can also order services, make requests, register to receive materials and send us communications. For example, you will be furnishing some of your personal information at the time you apply to rent from us, and such information can be from the rental application form or other documents that you provide to us or to an apartment locator service, either on paper or electronically. We collect your personal information when you communicate with us through the Site’s “Contact Us” form. Finally, we collect biometric information when you enroll to receive access controls, key access, and amenity access in our residential buildings.

II. Information collected automatically

We use various technologies to collect other types of information that do not directly reveal your identity (“Other Information”). If we associate Other Information with your personal information, we will treat the combined information as personal information in accordance with this Notice. For example, in order to measure the usefulness and efficiency of our Sites, we automatically track certain information from all visitors to our Sites. This information is compiled and analyzed on an aggregated basis, and we do not generally track anyone’s individually identifiable information.

III. Third party sources

We may also collect both public and nonpublic personal information about you, subject to applicable law, from a variety of third party sources. These include commercially-available third parties or our affiliates.

We collect this personal information for the purposes of and pursuant to the legal bases of contract performance, legal compliance and legitimate business interests, including but not limited to the following:

• To operate, evaluate and improve our business, including to:

○ evaluate rental applications and renewals; process and verify statements made on your rental application, such as your rental, credit and employment history;

○ obtain payments from you for any money you may owe us, now or in the future;

○ develop new business opportunities;

○ manage, operate and administer your accounts, including through the use of third party service providers;

○ process and consider applications for employment, including evaluate and confirm suitability for a position and accuracy of any information submitted;

○ monitor and audit compliance with policies and procedures and to meet applicable requirements and orders of regulatory authorities;

○ conduct Marketing Activities and provide newsletters, updates, invitations and other information of interest.

○ target advertisements to you on third-party platforms and websites (for more information and to opt out, see the Targeted Advertising and Analytics section below).

• To provide you with products and Rental Services;

• To improve and administer our Sites;

• To respond to your requests or inquiries or to otherwise provide user support;

• To prevent, investigate or provide notice of fraud, unlawful/criminal activity or unauthorized access to or use of personal information, Sites or data systems, to conduct risk mitigation activities to maintain and protect the safety and security of our Services, systems, premises and events, or to meet legal obligations, such as tax withholdings; and

• To investigate and resolve disputes and security issues and to enforce our Terms of Use and other agreements.

Other Business Contacts:

We collect the following categories of personal information:

• Contact information (including postal address and e-mail address, phone number);

• Other identification information (including name, ID card and passport numbers, Social Security number, nationality, place and date of birth, gender, picture);

• Family information (including marital status, number of children, family member names and contact details);

• Tax status information (including tax ID, tax residence);

• Professional and employment information (including resume details, employment history, personnel files, pay and benefits information);

• Financial information (including bank account details, credit card number, wire transfer instructions, assets, income, investor profile, investment experience, credit history and reports, debts and expenses);

• Account information (including username and password);

• Service-related information (including requests you make in connection with our Services);

• Other background information (including information on criminal history/unlawful conduct);

• Health information (including, if you attend our events, dietary restrictions or disabilities, or if a business we are considering investing in makes such information available to us); and

• Electronic identifying information (including IP address, Site activities, the Internet address you came from or go to, browser information, internet service provider information, date and timestamp information, clickstream information); and

• Sensitive information (as defined by applicable data protection laws) (including specific subset of personal information that includes certain government identifiers such as social security numbers, age, or citizenship).

We collect this personal information from:

I. Information you provide to us

In order for you to access certain Services and to order materials that we offer, we may require you to provide us with certain personal information. We may also collect information you provide to us in any communication between us, including phone calls, online form responses, and emails, which we may use to fulfill your requests and improve our services. On some of our Sites, you can also order services, make requests, register to receive materials and send us communications. For example, we collect your personal information when you:

• Give us your contact information;

• Seek financial advice;

• Make deposits or withdrawals from your account;

• Tell us about your investment or retirement portfolio;

• Give us your employment history; or

• Communicate with us through the Site’s “Contact Us” form.

II. Information collected automatically

We use various technologies to collect other types of information that do not directly reveal your identity (“Other Information”). If we associate Other Information with your personal information, we will treat the combined information as personal information in accordance with this Notice. For example, in order to measure the usefulness and efficiency of our Sites, we automatically track certain information from all visitors to our Sites. This information is compiled and analyzed on an aggregated basis, and we do not generally track anyone’s individually identifiable information.

III. Third party sources

We may also collect both public and nonpublic personal information about you, subject to applicable law, from a variety of third party sources. These include commercially-available third parties or our affiliates. personal information.

We use and collect your personal information for the purposes of and pursuant to the legal bases of contract performance, legal compliance and legitimate business interests, including but not limited to the following:

• To operate, evaluate and improve our business, including to:

○ make, maintain, manage or dispose of our investments;

○ conduct due diligence and evaluate business opportunities;

○ develop new investment opportunities;

○ manage, operate and administer investor accounts, including through the use of third party service providers;

○ obtain payments from you for any money you may owe us, now or in the future;

○ monitor and audit compliance with policies and procedures and to meet applicable requirements and orders of regulatory authorities; or

○ conduct Marketing Activities and provide newsletters, updates, invitations and other information of interest.

○ target advertisements to you on third-party platforms and websites (for more information and to opt out, see the Targeted Advertising and Analytics section below). To provide you with products and Investment Services

• To provide you with products and Investment Services;

• To improve and administer our Sites;

• To respond to your requests or inquiries or to otherwise provide user support;

• To prevent, investigate or provide notice of fraud, unlawful/criminal activity or unauthorized access to or use of personal information, Sites or data systems, to conduct risk mitigation activities to maintain and protect the safety and security of our Services, systems, premises and events, or to meet legal obligations, such as tax withholdings; and

• To investigate and resolve disputes and security issues and to enforce our Terms of Use and other agreements. We may also process personal information to perform a contract with you or to take steps at your request before entering into a contract.

• Finally, we may process personal information with your consent, but only in those cases where we make it clear to you in advance that we are relying on your consent for the processing. You may choose not to provide us with any individually identifiable information; in such an event, you may not be able to use those portions of our Services that require such information.

2. Sharing Information with Third Parties

We may share your personal information with our affiliates for business purposes consistent with this Notice, including for Marketing Activities. We may also disclose your personal information to you and your authorized representatives, as well as to the following third parties:

• Legal, governmental and regulatory authorities, including those outside your country of residence;

• Relevant parties performing services on our behalf or for your benefit, including for:

○ information technology services and related infrastructure, such as website hosting and residential portal hosting;

○ customer service, e-mail delivery, catering, document production, delivery services;

○ payment service providers to facilitate rent and other service fee payment transactions;

○ online leasing providers;

○ website analytics providers;

○ SMS text messaging provider;

○ professionals engaged for any investment matter (e.g., accountants, attorneys, counterparties, experts, mediators, opponents, and witnesses);

○ audit, insurance, tax or regulatory services;

○ insurance providers; and

○ other third-party service providers contractors we may engage to provide you specific services.

• Relevant parties for Marketing Activities;

• Relevant parties wherever necessary to establish, exercise, defend or enforce your or our legal rights, including responses to legal processes, and to enforce your or our contracts;

• Relevant parties for preventing, investigating, detecting or prosecuting criminal offenses;

• Relevant parties involved in connection with a corporate reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or capital, including for any bankruptcy or similar proceedings; and

• Relevant parties for protecting your or our operations, properties, rights, privacy, health and safety.

Third Party Websites

Our Sites contain links to websites operated by third parties. These other websites may have different information collection and privacy practices than HGI, HGMC or our affiliates, and we are not responsible for their privacy practices or content. We encourage you to review their privacy policies.

Targeted Advertising and Analytics

We engage others to provide analytics services, serve advertisements, and perform related services across the web and in mobile applications. To do this, we and/or our partners may use cookies, pixels, SDKs, and similar technologies to collect information about your use of our Services and other websites and mobile applications, including your device identifiers, IP address, web browser and mobile network information, pages viewed, time spent on pages or in mobile applications, links clicked, and conversion information. This information is used to deliver advertising targeted to you on other companies’ websites and mobile applications, understand the effectiveness of this advertising, analyze and track data, determine the popularity of certain content, and better understand your activity.

Depending on where you reside, you can opt out of ad targeting through cookies and similar technologies on our website by following the prompts behind the Your Privacy Choices link in the site footer. Your opt-out choice will be linked to your browser only; therefore, you will need to renew your opt-out choice if you visit our website from a new device or browser, or if you clear your browser’s cookies.

In addition to ad targeting activities that rely on cookies and similar technologies, we work with advertising partners to translate other identifiers, such as your email address or phone number, into a unique identifier (called a hashed value) that such partners can then use to show ads that promote our Services. Depending on where you reside, you may opt out of these disclosures by filling out our web form.

The activities described in this section may constitute “targeted advertising,” “sharing,” or “selling” under certain privacy laws. See the United States Privacy Rights & Disclosures section below for details.

You can also learn more about interest-based ads, or opt out of having your web browsing information used for behavioral advertising purposes by companies that participate in the Digital Advertising Alliance, by visiting www.aboutads.info/choices. Your device may also include a feature that allows you to opt out of having certain information collected through mobile applications used for behavioral advertising purposes.

3. Security

This Notice is adopted to help ensure that your personal information is kept secure. We have implemented security measures to protect your personal information against accidental or unlawful destruction, alteration or other unauthorized disclosure, use or access. Our technical and organizational measures include electronic and procedural safeguards, computer safeguards, adequate physical security barriers, secured files and buildings, and periodic employee privacy training focused on handling personal information. Access to your personal information is restricted to those employees who are trained in the proper handling of client information and have a legitimate business need to access such information. We monitor our security programs to ensure that your personal information is protected.

However, no data transmission or storage system can be guaranteed to be secure at all times. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the “How to Contact Us” section below.

4. Retention of Your Personal Information

We take steps to ensure that your personal information is processed for the minimum period required to fulfil the specific purposes for which it was collected. Our criteria for determining the data retention period consider multiple factors, including the amount, nature, scope and business purpose of the data collected. We will retain your personal information during an ongoing relationship with you, for as long as is necessary for the purposes set out in this Notice, unless a longer period is required or permitted under applicable law or is needed to resolve disputes or protect our legal rights. After we no longer need your personal information, we will store or destroy the information in a manner that ensures that no unauthorized person will have access to it. Our disposal method may include physical destruction or obliteration of paper documents or electronic files containing such information

5. Marketing

Occasionally, we or certain of our affiliates may process your personal information for Marketing Activities. You may receive marketing via multiple methods because you had chosen to receive them. You may also be required to explicitly opt-in for direct marketing in some situations. Regardless, you will always have an opportunity to manage your preferences by following the “unsubscribe” directions found in the received marketing communication.

Note that some messages are required, including service-related messages like transaction confirmation messages, legal notices, or updates.

6. Technology and Cookies

We use cookies and analytical technologies to provide you with a user-friendly experience. “Cookies” are small data files stored on your hard drive that store certain information accessible to our Sites, like your password or voluntarily-set preferences, which allow us to recognize you, manage your user preferences, deliver targeted communications, customize and enable content on our Sites and analyze your use of our Sites to make them more useful for you. A number of cookies we use will last only for the duration of your web session and expire when you close your browser; other cookies will last longer and are used to recognize your computer when you return to our Sites. You may always decline our cookies, if your browser permits, although in that case, you may not be able to use certain Site features and you may be required to reenter your password more frequently during a web session. Most internet browsers allow you to manage cookie functions and your privacy preferences. For information on how to do this, access the “help” menu on your internet browser or visit Aboutcookies.org.

In addition to cookies, we may use other tracking technologies, such as web beacons (for example, in the body of our emails) so that we know when you open an email from us or click on a link included in one of these emails. This helps us to understand whether particular content is of interest. Instructions on how to unsubscribe are included in each email.

The following cookies you receive from the Sites are served by us. However, some cookies served by us use code provided by a third party delivering analytical services on our behalf.

Necessary session management. These cookies manage your session on the Site, enabling you to navigate different pages of the Site during your session, understand when you have entered information and route content requests correctly.

Performance and Functionality Cookies: These cookies are used to enhance the performance and functionality of our Services but are non-essential to their use. However, without these cookies, certain functionality may become unavailable.

Analytics. Analytics cookies help us collect anonymous statistics on visitors to the Sites, where visitors have come to the Sites from, how long a user spends on the Sites and the pages they visited. This information is used solely for our internal purposes in managing Sites and improving their functionality.

To opt out of the aggregation and analysis of data collected about you on the Sites by Google Analytics, you can download and install the Google Analytics Opt-out Browser Add-on. For residents of certain U.S. states, please see the United States Rights & Disclosures section below to learn about additional choices available to you.

Third Party Cookies. Our third party vendors, such as Real Page, may use cookies to help provide you with our Services.

You can opt out of certain cookies through universal opt-out mechanisms such as the Global Privacy Control (“GPC”). The GPC is a browser extension users can download to communicate privacy preferences to the websites they visit. When a user turns on GPC, the browser sends a signal to the websites communicating the preferences.

The opt-outs described above are device-and browser-specific and may not work on all devices. If you choose to opt-out through any of these opt-out tools, this does not mean you will cease to see advertising. Rather, the ads you see will just not be based on your interests. Please note that new services using cookies may be added to the Sites from time to time. We aim to keep the cookies information as accurate as possible and use all reasonable efforts to regularly review and update the details.

7. United States Privacy Rights & Disclosures

Many states have recently passed privacy laws or are in the process of passing privacy laws that may apply to you (“State Privacy Laws”). If you reside in California, Colorado, Connecticut, Delaware, Maryland, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah or Virginia, this section applies to you. This section also serves as our California notice at collection.

Additional Disclosures

Our Notice explains how we collect and use information about Investors, Renters and Visitors, and Other Business Contacts, as well as how we disclose information about you and our targeted advertising and analytics practices. The information collected, used and disclosed depends on whether you interact with us as an Investor, Renter, Visitor, or Other Business Contact. As required by certain State Privacy Laws, we use the tables below to explain this same information.

Use and Disclosure of Personal Information for Business Purposes

We collect information that is considered “sensitive” under the State Privacy Laws as described in the Personal Information Sources and Types Collected section above, but we do not use or disclose sensitive personal information for the purpose of inferring characteristics about you.

As described in the Personal Information Sources and Types Collected section above, we collect personal information from various sources, including directly from you, automatically when you access or use our Sites, Rental or Investment Services, and from third-party sources.

We retain personal information for as long as necessary to carry out the purposes for which we originally collected it and for other purposes as described above in our Retention of Your Personal Information section.

Sales, Sharing, and Targeted Advertising Activities

The State Privacy Laws require that we provide transparency about personal information we “sell,” “share,” or use for targeted advertising. “Sale,” for the purposes of the State Privacy Laws, broadly means scenarios in which we have disclosed personal information with partners in exchange for valuable consideration, while “sharing” means we have disclosed information to a third party for cross-context behavioral advertising. In addition, the California Consumer Privacy Act has been interpreted to deem this “sharing” to also be a form of “sale.” We never disclose your personal data in exchange for money; however, we do disclose certain categories of personal data (including identifiers, internet or other electronic network activity information, and commercial information) with advertising and marketing networks to show you targeted ads on third-party properties and to expand the reach and effectiveness of our own marketing campaigns. These activities may be considered “sales,” “sharing,” or “targeted advertising” under certain state laws. See below for details about your privacy rights, including opt-out rights.

We do not knowingly sell or share personal information about consumers under the age of 18.

Your Rights under State Privacy Laws

Consistent with the State Privacy Laws, and subject to certain limitations, you may exercise the right to (1) Know more about the personal information we collect, use, and disclose and access this information, (2) receive your personal information in a portable format, (3) request deletion of your personal information, (4) request Correction of Inaccurate Information, (4) Opt Out of “Sales,” “Sharing,” or “Targeted Advertising”, and (5) not be discriminated against for exercising the rights listed in this section.

To opt out of sales, sharing, and targeted advertising, click on the Your Privacy Choices in the footer of our website. Please note that you will need to renew your opt-out choice at each HGI website you visit, if you visit our websites from a new device or browser, or if you clear your cookies.

For information about how to exercise any of the other rights listed above, including through an authorized agent, see the How to Exercise Privacy Rights section below.

Appeals 
 

If we deny your request, you may appeal our decision by contacting us at privacy@harborg.com. If you have concerns about the result of an appeal, you may contact the attorney general in the state where you reside.

Opt-out Preference Signals

You can also opt out by visiting our websites with a legally recognized universal choice signal enabled, such as GPC, as mentioned in the Technology and Cookies section above. Please be aware, however, that opt-out preference tools are limited to the browser or devise you are using, so you will need to renew your opt-out choice at each HGI website you visit, if you visit our websites from a new device or browser, or if you clear your cookies.

California Shine the Light Law

Individual Residents of California may request information about our disclosures of certain categories of personal information to third parties (i.e., our affiliates) for such third parties’ direct marketing purpose, consistent with California Civil Code Section 1798.83. Individual California residents may submit requests to us using the contact information listed in the “How to Contact Us” section.

In response, we will provide a list of the categories of “Personal Information”, as that term is defined by California Civil Code Section 1798.83, disclosed to third parties for direct marketing purposes during the immediately preceding calendar year, along with the names and addresses of these third parties.

8. European Union, UK and Swiss Privacy Rights & Disclosures

In addition to the applicable information provided elsewhere in this Notice, the disclosures below apply to any resident in the European Union (“EU”), the United Kingdom (“UK”) and Switzerland.

Certain laws, including but not limited to, the General Data Protection Regulation (“GDPR”) grant you rights to control your personal information. Consistent with these laws, we give you options to access, edit, or remove certain information, as well as choices about how we contact you. Although some of these rights apply generally, certain rights will only apply to limited individuals or circumstances.

To the extent that these laws apply, you may exercise the following rights:

• Right to Access. Note that much of the information you are entitled to know or access is disclosed in this Notice. You have the right to know about our information practices. You also have the right to access the categories of data we collect, with whom we share or sell that information, and, in some cases, what specific personal information we associate with you or your account.

• Right to Rectification. You may request we correct or rectify inaccurate information we have collected about you.

• Right to Erasure. You may request that we delete the personal information we have collected about you. Depending on the applicable law, in some cases we are required or permitted to retain your information, even if you validly requested we delete or erase it.

• Right to Restrict Processing. If we process your information based on our legitimate interests as explained in this Notice, you may have the right to restrict processing in certain circumstances.

• Right to Object. If we process your information based on our legitimate interests as explained in this Notice, or in the public interest, you can object to this processing in certain circumstances. Where we use your data for direct marketing purposes, you can always object using the unsubscribe link in such communications or changing your account settings.

• Right to Data Portability. If you request a copy of your specific information then we will provide it in an easily accessible format.

• Right to Lodge a Complaint. You may be entitled to lodge a complaint with your data privacy regulatory authority.

We generally process personal information of those residing in these countries on the legal basis of our legitimate interests in performing the function or service you requested. Where appropriate, we may rely on alternate legal bases, such as your consent to certain types of processing. Where we process your personal information on the basis of consent, we will clearly obtain your opt-in consent.

For purposes of the GDPR, we act as a “data controller” and our headquarters are located in the United States at 999 Waterside Drive, Suite 2300, Norfolk, VA 23510. As a data controller, we are responsible for deciding how we hold and use personal information about you.

The transfer of personal information to our entities outside of these covered countries is governed by data transfer agreements, which are in the form of the standard contractual clauses approved by the European Commission (a copy of which can be obtained from us via the contact details below). Where your personal information is processed by third parties outside of the EU, UK, and Switzerland, we will ensure that appropriate safeguards are in place to adequately protect your personal information, as required by applicable law, including the execution of standard contractual clauses (referred to above) if the recipients are not located in a country with adequate data protection laws (as determined by the European Commission).

9. International Privacy Rights & Disclosures

Other individuals in Andorra, Argentina, Australia, Canada, Cayman, Faroe Islands, Guernsey, Hong Kong, Israel, Isle of Man, Japan, Jersey, Mexico, New Zealand, Singapore, South Korea, Uruguay, and certain other jurisdictions may be entitled to various data subject rights.

Depending on your country of residence, these rights may vary. The rights may include, but are not limited to, the rights listed above, such as the right to opt out of collection and use, the right to access, the right to data portability, the right to withdraw consent, and the right to lodge a complaint with your relevant supervisory authority.

If you are a citizen of one of these countries and wish to know more about your rights and options, please contact us through the “How to Contact Us” section.

10. How to Exercise Privacy Rights

If you wish to exercise your privacy rights please call us toll-free at 1.866.221.3179 or email us at privacy@harborg.com. We will review your requests and respond accordingly. The rights described herein are not absolute and we reserve all of our rights available to us at law in this regard. Additionally, if we retain your Personal Information only in de-identified form, we will not attempt to re-identify your data in response to a privacy right request. If you make a request related to Personal Information about you, we may need to verify your identity. To do so, we will request that you match specific pieces of information you have provided us previously, as well as, in some instances, provide a signed declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request. If it is necessary to collect additional information from you, we will use the information only for verification purposes and will delete it as soon as practicable after complying the request. For requests related to particularly sensitive information, we may require additional proof of identification. We will process your request within the time provided by applicable law.

Authorized Agents

If you make a privacy rights request through an authorized agent, we may require written proof that the agent is authorized to act on your behalf. In some cases, we may contact the individual who is the subject of the request to verify their own identity or confirm the authorized agent has permission to submit the request.

Authorized agents may submit requests to opt-out of sales, sharing, or targeted advertising under State Privacy Laws using the Your Privacy Choices link in our website. For authorized agents who wish to make a request under the California Consumer Privacy Act, please contact us at the information provided above.

11. Restricted Use

Our Sites are not intended or designed to be used by children under the age of 13. We do not collect personally identifiable data from any person we know to be under the age of 13 and instruct children under 13 not to send us any personal information. If we become aware that a person submitting information to us is under 13, we delete the information as soon as we discover it and do not use it for any purpose nor disclose it to third parties.

Our Sites are operated from servers in the United States. BY USING OUR SITES AND PROVIDING INFORMATION TO US, YOU CONSENT TO THE TRANSFER AND PROCESSING OF YOUR PERSONAL INFORMATION IN THE UNITED STATES.

12. Investor Nonpublic Personal Information

In addition to the applicable information provided elsewhere in this Notice, the disclosures below apply to any current, prospective, and former investors of Harbor Group International, LLC, HGI Capital Management, LLC, or any of their affiliates. If you access your investor account through our Sites, you leave our Sites and navigate to a third party website that we do not own or control. To establish your investor account, we may have to provide the third-party provider with certain information you submitted to us. By submitting such information to us for the purposes of establishing an investor account, you agree that we are permitted to share such information with our third-party providers for such purpose. We require our third-party providers to only process your information for such specified purpose and to have adequate information security measures in place.

With respect to your personal information as a current, prospective, and former investor, we share such data as follows:

Federal law gives you some rights to limit the sharing of your information. Federal law gives you the right to limit only:

• sharing for affiliates’ everyday business purposes—information about your creditworthiness;

• affiliates from using your information to market to you; and

• sharing for nonaffiliates to market to you.

If you are a new investor, we may begin sharing your information 30 days from the date you are provided this Notice. When you are no longer an investor with us, we may continue to share your information as described in this Notice. However, any current, prospective or former investor can contact us at any time to limit our sharing in accordance with the “How to Contact Us” section below; investor questions and requests relating to their personal information should be directed to privacy@harborg.com. When you limit data sharing for an account you hold jointly with someone else, your choices will apply to everyone on your account unless you tell us otherwise.

13. Your Information

We generally seek to ensure that we keep your personal information accurate and up-to-date. However, you are responsible for, and we kindly request that you inform us of, any changes to your personal information (such as a change in your contact details). To update or edit your personal information that we have on file, including your communication preferences, please contact us in accordance with the “How to Contact Us” section below.

14. How to Contact Us

If you have any questions, comments, requests or complaints in connection with the Sites, this Notice and the disclosures contained within this Notice, our use of your personal information, and/or other privacy-related matters, please contact us at:

Email: privacy@harborg.com

Call: 1.866.221.3179

Write: Harbor Group International, LLC Attn: Legal & Compliance

999 Waterside Drive, Suite #2300

Norfolk, VA 23510

Please be advised that we may ask you to provide further information to verify your identity in responding to your inquiries or requests. Any personal information we receive from you when making privacy-related inquiries will be treated in accordance with this Notice and only used to the extent necessary to process the inquiries and to check on the level of service we provide.