Rex Holding SIA

Registration No. 42103076721 — Republic of Latvia

Last updated: 20.06.2026

1. Introduction

This Privacy Policy explains how Rex Holding SIA, registration number 42103076721, registered in the Republic of Latvia (“Rex Holding”, “we”, “us”, “our”), collects, uses, stores, and protects personal data when you visit our website, contact us, or engage with our advisory services. We act as the data controller for the personal data described in this policy, in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Latvian law.

2. Data We Collect

Depending on how you interact with us, we may collect:

• Identity data — name, job title, company name.
• Contact data — email address, phone number, business address.
• Engagement data — details you provide when submitting an enquiry, registering interest, or entering into an advisory engagement, such as your investment focus, sector interests, or project information.
• Communication records — emails, call notes, meeting notes, and messages exchanged with us.
• Documents you share — business plans, financial information, or due diligence materials submitted in connection with an advisory mandate.
• Technical data — IP address, browser type, device information, and website usage data collected via cookies and similar technologies (see Section 8).

We do not intentionally collect special categories of personal data (e.g. health, religion, political opinions) and ask that you do not submit such data to us unless specifically and legitimately relevant to an engagement, in which case we will agree the appropriate basis with you separately.

3. How We Use Personal Data

We use personal data to:

• Respond to enquiries and communicate about our Services.
• Assess, structure, and progress advisory mandates, including capital raising and M&A engagements.
• Make introductions between clients and potential investors, partners, or counterparties, where you have requested or consented to this.
• Maintain and improve our website and the security of our systems.
• Meet legal, regulatory, accounting, and tax obligations, including anti-money-laundering and know-your-customer checks where applicable.

We do not sell personal data to third parties, and we do not use personal data for automated decision-making that produces legal or similarly significant effects on you.

4. Legal Basis for Processing

We rely on the following legal bases under Article 6(1) GDPR, depending on the activity:

• Contractual necessity (Art. 6(1)(b)) — to take steps requested by you before entering into an engagement, and to perform an advisory agreement.
• Legitimate interests (Art. 6(1)(f)) — to operate and improve our business, respond to general enquiries, and maintain relationships with clients, investors, and partners, balanced against your rights and interests.
• Legal obligation (Art. 6(1)(c)) — to comply with accounting, tax, and anti-money-laundering requirements.
• Consent (Art. 6(1)(a)) — where we ask for your specific consent, for example for optional marketing communications or non-essential cookies, which you may withdraw at any time.

5. Data Sharing

We may share personal data with:

• Investors, project owners, or counterparties, but only where you have requested or agreed to an introduction, or as necessary to progress a mandate you have engaged us for.
• Professional advisors — such as legal counsel, auditors, or due diligence providers — engaged to support an advisory mandate, under appropriate confidentiality obligations.
• Service providers who support our operations (e.g. IT hosting, email, and website infrastructure providers), acting on our instructions and under data processing agreements where required.
• Regulatory or public authorities, where we are legally required to do so.

We do not transfer personal data outside the European Economic Area (EEA) unless an adequate level of protection is ensured, for example through an adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

6. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy, including to meet legal, accounting, or reporting requirements. As a general rule, enquiry and prospect data is retained for up to 2 years from last contact unless an engagement proceeds, and engagement-related records are retained for the period required by Latvian commercial and tax law (generally up to 5–10 years from the end of the relevant engagement), after which it is securely deleted or anonymised.

7. Data Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration, including access controls, encryption where appropriate, and confidentiality obligations on staff and advisors handling sensitive deal information. No system can be guaranteed completely secure, and we continuously review our practices in line with industry standards.

8. Cookies and Similar Technologies

Our website uses cookies and similar technologies to ensure core functionality, remember your preferences, and (where you consent) measure website usage and support marketing activities. You can manage your cookie preferences at any time via the consent banner or your browser settings. Disabling certain cookies may affect website functionality.

9. Your Rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data, where applicable.
• Request restriction of, or object to, certain processing.
• Receive your data in a portable format, where technically feasible.
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija) or another competent supervisory authority.

To exercise any of these rights, please contact us using the details in Section 10.

10. Contact

Rex Holding SIA

Registration No. 42103076721 — Republic of Latvia

Registered address:Strautu street 4, Liepaja

Email: invest@rex-holding.com

Phone: +371 22573226

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top of this page indicates the most recent revision. We encourage you to review this page periodically.