Introduction & Data Controllers
OTR Partners and its affiliated fund vehicles, General Partners, Special Purpose Vehicles (SPVs), and advisory entities established in the British Virgin Islands, the State of Delaware (USA), the Grand Duchy of Luxembourg, and the Republic of Korea (collectively, "OTR Partners," "we," "us," or "our") respect your privacy and are committed to protecting your personal data.
Depending on the specific partnership or entity with which you interact, the relevant OTR Partners legal entity acts as the Data Controller (under the EU General Data Protection Regulation ("GDPR") and the BVI Data Protection Act, 2021 ("BVI DPA")) or Personal Information Controller (under the South Korean Personal Information Protection Act ("PIPA")).
Categories of Personal Data We Collect
In the course of operating our website, managing our Limited Partner ("LP") relationships, and executing intellectual property and private equity transactions, we may collect and process the following categories of personal data:
- Identity & Contact Data: Full name, date and place of birth, nationality, passport/government ID numbers, residential and business addresses, email addresses, and telephone numbers.
- Technical & Portal Usage Data: IP addresses, cryptographic login timestamps, device identifiers, and audit logs within the encrypted LP Investor Portal.
Purposes and Legal Bases for Processing
We process your personal data strictly on the following legal bases:
- Performance of a Contract: To process your Subscription Agreement, administer your Limited Partnership interest, execute capital calls and distributions, and fulfill obligations under our Limited Partnership Agreements ("LPAs") or asset acquisition contracts.
- Compliance with Legal & Regulatory Obligations: To comply with mandatory Anti-Money Laundering (AML), Know Your Customer (KYC), counter-terrorist financing, FATCA/CRS tax reporting, and regulatory supervision across the BVI, USA, Luxembourg, and South Korea.
- Legitimate Interests: To safeguard our IT infrastructure, conduct investment due diligence, prevent fraud, and manage institutional stakeholder communications.
- Consent: Where required by applicable law (specifically under South Korean PIPA for separate categories of collection and third-party provision, or for non-essential cookies).
Disclosures & Cross-Border Data Transfers
Due to the global nature of OTR Partners' Master-Feeder and SPV architecture, your personal data may be transferred to and processed in jurisdictions outside your country of residence, including the British Virgin Islands, the United States, the Grand Duchy of Luxembourg, and the Republic of Korea.
We share personal data strictly on a need-to-know basis with:
- Independent third-party Fund Administrators, Custodians, and Tier-1 Banking institutions;
- Legal counsel, independent auditors, and tax advisors (for K-1, GAAP/IFRS, and FATCA/CRS reporting);
- Competent regulatory, tax, and supervisory authorities (including the BVI FSC, BVI International Tax Authority, US IRS/FinCEN, Luxembourg CSSF/ACD, and Korean FSS/KoFIU) where required by law.
When transferring personal data outside the European Economic Area (EEA), the BVI, or South Korea, we implement legally recognized safeguards, including EU Standard Contractual Clauses (SCCs), statutory adequacy mechanisms, and encrypted data transmission protocols.
Data Retention
We retain personal data for the duration of your investment or commercial relationship with OTR Partners and for a mandatory statutory period thereafter—typically five (5) to seven (7) years following the termination of the relationship or the liquidation of the relevant Fund vehicle—to satisfy applicable AML, tax, and corporate record-keeping laws in the BVI, Delaware, Luxembourg, and South Korea.
Jurisdiction-Specific Privacy Rights
Depending on your residency and the OTR Partners entity with which you interact, you hold specific statutory rights:
- EEA / Luxembourg (GDPR) & British Virgin Islands (BVI DPA): You have the right to request access to your personal data, rectification of inaccuracies, erasure ("right to be forgotten," subject to statutory AML/tax retention overrides), restriction of processing, data portability, and the right to object to processing. You also have the right to lodge a complaint with the Commission Nationale pour la Protection des Données (CNPD) in Luxembourg or the Office of the Information Commissioner in the BVI.
- United States (GLBA / CCPA): Under Regulation S-P and the Gramm-Leach-Bliley Act, non-public personal information collected from individual investors is protected by strict institutional confidentiality and is never sold to third-party marketers.
- Republic of Korea (PIPA): Data subjects in South Korea have the right to inspect their personal information, demand correction or deletion, request suspension of processing, and withdraw consent. When personal data is destroyed upon expiration of the retention period, electronic files are permanently erased using irreproducible cryptographic overwriting, and physical documents are shredded.