1. INTRODUCTION

This Privacy Policy describes how Investor Cash Management Holdings Inc. (hereinafter "Investor Cash Management" "we" or "us") needs to collect, use, disclose, transfer, store, retain, or otherwise process your Personal Data in order to service your account maintained at Investor Cash Management. This Privacy Policy, along with guidelines for processing of Personal Data, constitutes the overall framework for how we process your Personal Data within Investor Cash Management.

2. INFORMATION WE COLLECT

Investor Cash Management will collect personal information from you to establish your Cash Management Account pursuant to U.S. Banking and Securities Laws and to confirm your identity. Generally, we may collect the following information in order to establish, maintain, and service your Cash Management Account:

• Personal Identification Information. Your full legal name; address; date of birth; Tax ID, Social Security, or other government issued identification number; telephone number; email address; occupation industry.
• Financial Information. Such as your bank account information and income.
• Transaction Information. Pursuant to applicable law, we keep official books and records on all transactions which are conducted in your account, including trades, deposits, withdrawals, and payment activity.
• Other Information. There may be instances where we request additional information in order to properly service your account, provide our services, and/or comply with applicable law.

We also collect information about you from other third-party sources for various purposes including, but not limited to:

• Identity Verification Services. Investor Cash Management uses a third-party service to assist in making a good verification of your identity in accordance with U.S. regulations. Publicly available records may also be used as part of the verification process.

3. PERSONAL DATA

"Personal Data" is any information which may be related to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, location data, phone number, email and age. Your Personal Data falls into one of two categories at Investor Cash Management:

• Traditional Personal Data. Is considered any Personal Data which can be used to "identify" an individual and includes legal name, date of birth, address, government issued identification number ("Personal Identification Information").
• Digital Personal Data. Is considered any Personal Data which can be used to "link" to an individual and includes information which, when combined with other Personal Data, could logically link an individual to their identity, such as financial information, telephone number, IP address, and email address.

Regardless of the category of your Personal Data, such information shall always be:

• processed lawfully, fairly and in a transparent manner in relation to the data subject;
• collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
• adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
• accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that Personal Data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
• kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the Personal Data is processed;
• processed in a manner that ensures appropriate security of the Personal Data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or partneral measures.

To the extent there are any changes to your Personal Data, you should contact Investor Cash Management. You may also update your Personal Data via the CMA web portal or mobile app. We may need to verify your identity if you request a change to your information.

4. HOW INVESTOR CASH MANAGEMENT USES PERSONAL DATA

Investor Cash Management collects personal information in order to establish your Cash Management Account ("CMA"), send you account-related communications, verify your identity, identify and prevent fraud or other illegal activity, and comply with and support our banking and brokerage partners' obligations under applicable law.

5. HOW INVESTOR CASH MANAGEMENT SHARES PERSONAL DATA

Investor Cash Management may share your Personal Data with its Affiliates and third-party vendors. In such instances, Investor Cash Management will only share the minimum amount of information required to provide, maintain, and improve upon the services we provide.

Personal Data (Traditional and Digital) is shared with Affiliates and third-party vendors as follows:

• To confirm your identity
• To maintain transaction and brokerage records related to your CMA.
• To prepare annual tax documentation.

In certain cases, Investor Cash Management may share your Digital Personal Data with the following third-parties in order to provide the Services:

• Secondary Database providers which Investor Cash Management uses to perform certain transaction and brokerage services. Secondary Database providers include software and database providers used to store information.
• Payment verification providers, such as Plaid, which Investor Cash Management uses to verify the validity of deposits and withdrawals.
• Corporate Action service provider which Investor Cash Management uses to provide notification on all Corporate Actions for which you are eligible. Corporate Actions include communications which may have an economic impact on a shareholder's Account including proxy statements, ballots, information regarding voluntary and involuntary corporate actions, other shareholder materials.
• Communications vendor (non-marketing related) which Investor Cash Management uses to assist in sending you information related to your account and investments.

Your Personal Data is also maintained within Amazon Web Services, which Investor Cash Management uses as its primary database provider to process and store your information. All information within Amazon Web Services is secured by Investor Cash Management Information Security procedures which means that no individual within Amazon can view your Personal Data.

6. ADVERTISING AND MARKETING

Investor Cash Management will not share your Personal Data for advertising or Joint Marketing purposes. We will only contact you in instances where it is necessary to service your account or where we are required to do so under applicable law.

7. LEGAL BASIS FOR PROCESSING PERSONAL DATA

Processing of Personal Data requires a legal basis. The most predominant legal basis for processing Personal Data within Investor Cash Management are: (i) Consent from the data subject for one or more specific purposes; (ii) The performance of a contract to which the data subject is party; (iii) A legal obligation or requirement; and (iv) legitimate interests pursued by Investor Cash Management.

• Consent. If the collection, registration and further processing of Personal Data on clients, suppliers, other business relations and employees are based on such a person's consent to the processing of Personal Data for one or more specific purposes, Investor Cash Management shall be able to demonstrate that the data subject has consented to processing of such Personal Data. Consent shall be freely given, specific, informed and unambiguous. The data subject must actively consent to the processing of Personal Data by a statement or by a clear affirmative action, to him/her. A request for consent shall be presented in a manner which is clearly distinguishable from other matters, in an intelligible and easily accessible form, and using clear and plain language. To process special categories of Personal Data (sensitive Personal Data) the consent shall also be explicit. The data subject is entitled to withdraw his/her consent at any time and upon such withdrawal, we will stop collecting or processing Personal Data about that person unless we are obligated or entitled to do so based on another legal basis.
• Necessary for the Performance of a Contract. It will be legitimate to collect and process Personal Data relevant to the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. This applies to all contractual obligations and agreements signed with Investor Cash Management, including the pre-contractual phase irrespective of the success of the contract negotiation or not.
• Comply with a Legal Obligation. Investor Cash Management must comply with various legal obligations and requirements. Such legal obligation, to which Investor Cash Management is subject, may be sufficient as a legitimate basis for processing of Personal Data. Investor Cash Management and entities to which it is contracted to provide services are required to comply with U.S. Securities, Banking, and Treasury Laws, such as the Bank Secrecy Act. Such legal obligations include obligations to collect, register and/or make available certain types of information relating to clients. Such legal requirements will then form the legal basis for us to process the Personal Data, however, it is important to note whether the provisions allowing or requiring Investor Cash Management to process certain Personal Data also set out requirements in relation to storage, disclosure and deletion.
• Legitimate Interests. Data will only be processed where it is necessary for the purposes of the legitimate interests pursued by Investor Cash Management, and these interests or fundamental rights are not overridden by the interests of the data subject. Investor Cash Management will, when deciding to process data ensures that the legitimate interests override the rights and freedoms of the individual and that the processing would not cause unwarranted harm. For instance, it is a legitimate interest of Investor Cash Management to process Personal Data on potential customers in order to verify the identity of the customer. The data subject must be given information on the specific legitimate interest if a processing is based on this provision.

8. PROCESSING AND TRANSFER OF PERSONAL DATA

In order to establish and maintain your CMA, Investor Cash Management may disclose your Traditional and Digital Personal Data to third-party service providers, such as our bank partners, payment processors, payment networks, card fulfillment vendors, identity services, communication platforms, risk investigation and mitigation services, investment advisors, broker-dealers and asset managers, website and application use trackers, data processors, and network infrastructure and data storage services. These third-party service providers are contractually obligated to secure and refrain from sharing or disclosing Personal Data disclosed to them.

9. RIGHTS OF THE DATA SUBJECTS

When Investor Cash Management collects and registers Personal Data on data subjects Investor Cash Management is obligated to inform such persons about:

• The purposes of the processing for which the Personal Data are intended as well as the legal basis for the processing;
• The categories of Personal Data concerned;
• The legitimate interests pursued by Investor Cash Management, if the processing is based on a balancing of interests;
• The recipients or categories of recipients of the Personal Data, if any;
• Where applicable, the fact that Investor Cash Management intends to transfer Personal Data to a third party and the legal basis for such transfer;
• The period for which the Personal Data will be stored, or if that is not possible, the criteria used to determine that period;
• The existence of the right to request from Investor Cash Management access to and rectification or erasure of Personal Data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;
• Where the processing is based on the data subject's consent, the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
• The right to lodge a complaint with Investor Cash Management via the correct procedure or with a supervisory authority;
• Whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the Personal Data and of the possible consequences of failure to provide such data; and
• The existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

This information will in most cases be provided via a privacy notice on Investor Cash Management's home page (www.investorcashmanagement.com).

Any person who has provided Personal Data to Investor Cash Management to facilitate the establishment of his/her Cash Management Account has the right to request access to the Personal Data.

• If Investor Cash Management processes or stores Personal Data about the data subject, the data subject shall have the right to access the Personal Data and the reasons for the data to be processed in relation to the criteria set out in this section.
• The data subject shall have the right to obtain from Investor Cash Management without undue delay the rectification of inaccurate Personal Data concerning him or her.
• The data subject shall have the right to obtain from Investor Cash Management the erasure of Personal Data concerning him or her and Investor Cash Management shall have the obligation to erase Personal Data without undue delay, unless required by law to retain any information for a prescribed period of time, for example, by financial regulators or tax authorities.
• The data subject shall have the right to obtain from Investor Cash Management restriction of processing, if applicable.
• The data subject shall have the right to receive the Personal Data registered in a structured and commonly used and machine-readable format, if applicable.
• The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of Personal Data concerning him or her which is based on a balancing of interests, including profiling.

Any requests received from a data subject to exercise the rights in this clause will be answered as soon as reasonably possible, and no later than 30 days from receipt.

10. RECORDS OF BROKERAGE AND PAYMENT ACTIVITIES

Investor Cash Management shall maintain records of brokerage and payment activities under Investor Cash Management's responsibility. The records shall contain the following information:

• The name and contact details of the Account owner;
• A description of the categories of data subjects and of the categories of Personal Data;
• The recipients to whom the Personal Data have been or will be disclosed, including recipients in third parties;
• Where possible, the envisaged time limits for erasure of the different categories of data; and
• Where possible, a general description of the applied technical and partneral security measures.

Investor Cash Management shall make the records available to relevant data protection authorities upon request.

11. DELETION OF PERSONAL DATA

Personal Data shall be deleted when Investor Cash Management no longer has a legitimate purpose for the continuous processing or storage of the Personal Data, or when it is no longer required to store the Personal Data in accordance with applicable legal requirements.

12. LEGAL REQUIREMENTS

Investor Cash Management shall comply with federal and state data protection legislation. If applicable legislation requires a higher level of protection for Personal Data than such policies/guidelines, such stricter requirements are to be complied with. If Investor Cash Management's policies/guidelines are stricter than the legislation, our policies/guidelines must be complied with.

13. SECURITY

Investor Cash Management has adopted several internal and external data protection policies, which must be adhered to by employees of Investor Cash Management. Additionally, Investor Cash Management will monitor internal compliance with the data protection policies and applicable statutory data protection requirements. Investor Cash Management will also take the necessary steps to enhance data protection compliance within the partner. These steps include the assignment of responsibilities, raising awareness and training of staff involved in processing operations. Please note that this Privacy Policy will be reviewed from time to time to take into account any new obligations and that any Personal Data we hold will be governed by our most recent policy.

14. CHANGES TO THIS PRIVACY POLICY

Investor Cash Management may amend this Privacy Policy periodically by posting a revised version on its website and updating the Effective Date. The updated version will be effective as of the updated "Effective Date." If you disagree with any of the changes, you may contact us to close your account. Your continued use of our Services after the Effective Date constitutes your consent to any changes to our Privacy Policy. The current version of our Privacy Policy can be found at www.investorcashmanagement.com/privacy-policy.

15. CONTACT

If you have any questions regarding the content of this Privacy Policy, or believe that we have not protected your Personal Data in accordance with this Privacy Policy and wish to file a complaint, please contact Investor Cash Management at support@investorcashmanagement.com. We may request that you provide us additional information regarding your concerns so that we can adequately investigate and address your issue. Note that any additional information we request, and communications with you, may be retained as part of our records; all records will be kept confidential and any Personal Data will be maintained in accordance with this Privacy Policy.

16. DEFINITIONS

• "Affiliates" mean companies related by common ownership or control. They can be financial companies and nonfinancial companies.
• "Nonaffiliates" mean companies that are not related by common ownership or control. They can be financial and nonfinancial companies. Investor Cash Management does not share Personal Data with nonaffiliates so that they can market to you.
• "Joint Marketing" refers to a formal agreement between nonaffiliated financial companies that together market financial products or services. Investor Cash Management does not engage or use your Personal Data for Joint Marketing purposes.

17. OTHER IMPORTANT INFORMATION

For Nevada residents. We are providing you this notice pursuant to state law. You may be placed on our internal Do Not Call List by calling 800-326-7141. Nevada law requires that we also provide you with the following contact information: Bureau of Consumer Protection, Office of the Nevada Attorney General, 555 E. Washington St., Suite 3900, Las Vegas, NV 89101; Phone number - (702) 486-3132; email: BCPINFO@ag.state.nv.us.

For Vermont Residents. In accordance with Vermont law, we will not share information we collect about Vermont residents with companies who are Nonaffiliates, except as permitted by law, such as with your consent or to service your accounts. We will not share information about your creditworthiness with our Affiliates without your authorization or consent, but we may share information about our transactions or experiences with you with our Affiliates without your consent.

For California Residents. In accordance with California law, we will not share information we collect about you with Nonaffiliates, except as allowed by law. For example, we may share information with your consent or to service your accounts. Among our Affiliates, we will limit information sharing to the extent required by California law.