Privacy Policy

Last updated on 24 Aug 2026

This Privacy Policy is designed to help you understand how we collect, use, disclose and safeguard your personal data when you use this website and when you interact with DCY Fund SCSp (the “Fund”) and its related services.

1. Who we are and scope of this Policy

This Privacy Policy applies to the processing of personal data carried out in the context of:

• The operation of this website; and
• The provision of services and activities related to the DCY Fund SCSp, an alternative investment fund (AIF) established in Luxembourg and managed by OWL Inclusive S.A., a duly authorised alternative investment fund manager (AIFM).

For the purposes of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the data controller will typically be:

• DCY Fund SCSp, and, where applicable,
• OWL Inclusive S.A. in its capacity as AIFM of the Fund.

In this Policy, “we”, “us” or “our” refer to the Fund and, where relevant, its AIFM.

Contact details for privacy matters:

• Email: support@dcy.fund
• Address: 54, rue Charles Martel, L-2134 Luxembourg, Grand Duchy of Luxembourg

2. Categories of personal data we collect

Depending on your relationship with us (website visitor, prospective investor, investor, representative of a legal entity, counterparty, service provider), we may collect the following categories of personal data:

Identification and contact data

• Name, title, nationality, date and place of birth
• Address, email address, telephone number
• Copies of ID documents, KYC forms and signatures

Professional and financial data

• Employment details, position, professional contact information
• Bank account details, subscription and redemption information
• Information on your investment profile (investor category, well-informed / professional status, eligibility, risk tolerance where applicable)

Regulatory and compliance data

• Information required for AML/CTF checks, sanctions screening and other regulatory obligations
• Information obtained from public sources or third-party databases (e.g. sanctions lists, adverse media)

Technical and website usage data

• IP address, device identifiers, browser type, operating system, time and duration of visits
• Pages viewed, clickstream data, preferences and choices made on the website
• Data collected via cookies and similar technologies (for more details, please refer to our Cookie Policy)

Communication and interaction data

• Content of emails, messages, forms and any other communication with us
• Records of meetings, calls or written exchanges when relevant.

We generally obtain this data directly from you (or from your advisers), and, where necessary, from public sources or specialised third-party providers (e.g. KYC/AML service providers, banks, distributors).

3. Purposes of processing and legal bases

We process your personal data for the following purposes and on the corresponding legal bases:

Management of your relationship with the Fund and its AIFM

Processing subscription and redemption requests, maintaining the register of investors, communicating with you and your advisers, handling queries.

Legal bases:

• Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR);
• Compliance with legal obligations (Art. 6(1)(c) GDPR);
• Legitimate interests (efficient / secure management of the Fund) (Art. 6(1)(f) GDPR).

Compliance with legal and regulatory obligations

AML/CTF checks, identification and verification of investors, sanctions screening, reporting to competent authorities (including the CSSF), tax reporting (e.g. FATCA/CRS, where applicable), maintenance of statutory records.

Legal bases:

• Compliance with legal obligations under Luxembourg and EU law (Art. 6(1)(c) GDPR);
• Where applicable, performance of a contract (Art. 6(1)(b) GDPR).

Website operation, security and improvement

Operating and securing the website and troubleshooting it.

Measuring how the website is used. Every page of this website loads Cloudflare Web Analytics, a measurement script served from static.cloudflareinsights.com. It counts page views and records, for each one, the page requested, the referring website if you arrived from one, the country your request comes from, and the class of device and browser you are using. It sets no cookie, stores nothing on your device and derives no identifier from it, so it cannot recognise you on a later visit, build a profile of you, or follow you across other websites. Because nothing is read from or stored on your terminal equipment, we do not ask for your consent for it. The data is processed by Cloudflare, as our processor, and we only ever see aggregate figures.

Protection of our forms against automated abuse. The documentation request form is open to anyone and triggers an email from us. Left unprotected, it could be used to send unwanted messages, in our name and from our domain, to a person who never asked for them. To prevent this, the three product pages that carry the form (BTC Yield, USD Yield and Digital Dynamic) display a Cloudflare Turnstile verification widget, which distinguishes a human visitor from an automated one. The widget is loaded from challenges.cloudflare.com, so on those three pages your IP address and technical signals about your browser and device are transmitted to Cloudflare for that purpose. It sets no cookie, stores nothing on your device, and is not used to track or profile you or to follow you across other websites. No other page of this website loads it.

Legal bases:

• Legitimate interests (proper functioning, security and improvement of the website, understanding how it is used, and protection of our forms and of third parties against automated abuse) (Art. 6(1)(f) GDPR), giving effect to our obligation to ensure the security of processing (Art. 32 GDPR);
• Your consent, for any technology we may introduce that stores information on your device or reads information already stored there, beyond what is strictly necessary (Art. 6(1)(a) GDPR).

Marketing and investor relations

Sending you information about the Fund, newsletters, updates and event invitations that may be relevant to you as a professional or well-informed investor.

Legal bases:

• Legitimate interests (informing existing/prospective professional investors about our products) (Art. 6(1)(f) GDPR);
• Consent where required by applicable law (Art. 6(1)(a) GDPR).

You may opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting us.

Risk management, fraud prevention and dispute handling

Monitoring, preventing and investigating fraud, unlawful or abusive activities; managing and defending legal claims.

Legal bases:

• Legitimate interests (protecting our business, investors and assets) (Art. 6(1)(f) GDPR);
• Compliance with legal obligations (Art. 6(1)(c) GDPR).

Where we rely on consent, you may withdraw your consent at any time, without affecting the lawfulness of processing carried out before such withdrawal.

4. Recipients of your personal data

We may share your personal data, on a need-to-know basis, with the following categories of recipients:

• Service providers involved in the administration, management and operation of the Fund and the website (e.g. AIFM, administrator, depositary/custodian, paying agent, auditors, IT and cloud providers, KYC/AML service providers, legal and tax advisers).
• Regulatory and supervisory authorities, tax authorities and other public bodies where required by law (including the CSSF and other competent regulators).
• Banks, brokers, trading venues and counterparties involved in executing the Fund’s investment strategies.
• Professional advisers and external consultants (lawyers, auditors, consultants) where necessary for the protection of our rights and interests.

One recipient is named here because it is involved every time you open a page:

• Cloudflare, Inc. hosts and delivers this website, provides the Turnstile verification described in section 3, and provides the page-view measurement described in the same section. It therefore receives the technical data needed to serve you a page (including your IP address), the page view itself with the limited technical detail listed in section 3, and, on the three product pages only, the browser and device signals used to verify that a form is submitted by a human. Cloudflare acts as our processor, on our instructions and under a data processing agreement, not as an independent controller.

We do not sell your personal data to third parties.

5. International data transfers

Some of the recipients mentioned above may be located in countries outside the European Economic Area (EEA) which may not provide the same level of data protection as within the EEA.

In such cases, we ensure that appropriate safeguards are implemented in accordance with the GDPR, such as:

• An adequacy decision by the European Commission; or
• Standard Contractual Clauses or other appropriate contractual safeguards.

This applies in particular to Cloudflare, Inc., named in section 4, which is established in the United States. Cloudflare is certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection for personal data transferred to certified US organisations. Where that certification does not apply, the transfer is governed by the Standard Contractual Clauses adopted by the European Commission.

You may contact us at support@dcy.fund for further information on the safeguards applicable to specific transfers.

6. Data retention

We retain your personal data only for as long as necessary to achieve the purposes described in this Policy and to comply with applicable legal and regulatory obligations, in particular:

• For investors and their representatives: for the duration of the investment and for a period thereafter as required by Luxembourg commercial, financial and AML laws (often several years after the end of the relationship).
• For website visitors and prospects: for the period necessary to respond to your requests, manage our relationship with you and, where applicable, for a limited period for marketing activities, unless you object or withdraw your consent.
• For cookies and similar technologies: in accordance with the retention periods set out in our Cookie Policy.
• For the page-view measurement described in section 3: the figures are held by Cloudflare for six months and are then no longer available to us. We keep no copy of our own, and nothing about that measurement is stored on your device.

When data is no longer needed, it is securely deleted or anonymised.

7. Security measures

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, including:

• Access controls and authentication mechanisms;
• Encryption and secure communication channels where appropriate;
• Segregation of duties and restricted access on a need-to-know basis;
• Regular reviews and updates of our security measures and procedures.

While we strive to protect your personal data, no system can be completely secure and we cannot guarantee absolute security.

8. Your rights under GDPR

Subject to the conditions and limitations set out in the GDPR and applicable law, you have the following rights regarding your personal data:

• Right of access: to obtain confirmation as to whether we process your personal data and to receive a copy of such data.
• Right to rectification: to have inaccurate or incomplete data corrected.
• Right to erasure (“right to be forgotten”): to request the deletion of your data in certain circumstances.
• Right to restriction of processing: to request that we limit the processing of your data in certain situations.
• Right to data portability: to receive your data in a structured, commonly used and machine-readable format and to transmit it to another controller where technically feasible.
• Right to object: to processing based on our legitimate interests, on grounds relating to your particular situation; and at any time, to the processing of your data for direct marketing purposes.
• Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time.

To exercise your rights, please contact us at:

• Email: support@dcy.fund
• Address: 54, rue Charles Martel, L-2134 Luxembourg

Please note that we may need to verify your identity before responding to your request, and that legal or regulatory obligations may prevent us from fully complying with certain requests (in particular regarding AML/CTF and statutory record-keeping).

You also have the right to lodge a complaint with the Commission Nationale pour la Protection des Données (CNPD), the Luxembourg data protection authority, or with your local supervisory authority.

9. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes in our processing activities, in applicable law or in guidance from supervisory authorities. Any updates will be published on this website with an updated “last updated” date.

We encourage you to review this Privacy Policy regularly to stay informed about how we process your personal data.