Last Updated: September 18, 2025

1. INTRODUCTION

At Understory (“Company,” “we,” “us,” or “our”), we value your privacy and are committed to protecting your personal data.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website www.understoryfund.com.

It also describes your rights under the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

By using the Site, you acknowledge this Privacy Policy. Where required by law, we will seek your explicit consent before processing your personal data.

2. DATA CONTROLLER

The data controller responsible for your personal information is:

Deeproot Fund Management, LLC

143 Metairie Heights Ave. Metairie, LA 70001

Email: manager@understoryfund.com

If you are located in the EU/EEA and we do not have an establishment there, our EU representative is:

Quantum Counsel, LLC Jarred Bradley jpb@thequantumcounsel.com

3. INFORMATION WE COLLECT

We may collect and process the following categories of personal data:

• Personal Information: Name, email address, phone number, and any information you voluntarily provide when contacting us or signing up for services.
• Usage Data: IP address, browser type, device information, pages visited, time spent on the Site, and other diagnostic data.
• Cookies & Tracking Technologies: We use cookies, web beacons, and similar technologies. Non-essential cookies are used only with your consent.

4. LEGAL BASES FOR PROCESSING

We process your personal data under the following GDPR legal bases:

• Performance of a Contract: To provide, operate, and maintain the Site and services you request.
• Consent: To send marketing communications, use non-essential cookies, or collect certain analytics data.
• Legitimate Interests: To improve and personalize your experience, analyze usage trends, and protect the security of our Site.
• Legal Obligation: To comply with applicable laws or respond to lawful requests.

5. HOW WE USE YOUR INFORMATION

We use the collected data to:

• Provide and maintain our Site and services
• Personalize your experience
• Communicate with you, including sending updates and marketing content (only if you have consented)
• Monitor and analyze usage trends
• Detect, prevent, and address technical or security issues

6. SHARING YOUR INFORMATION

We do not sell or rent your personal data.

We may share your information:

• With trusted service providers who perform services on our behalf and under contractual confidentiality obligations
• To comply with legal obligations or protect our legal rights
• In connection with a business transfer, such as a merger, acquisition, or sale of assets

7. INTERNATIONAL DATA TRANSFERS

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States.

Where we transfer data outside the EEA, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission, or
• An adequacy decision where applicable.

8. DATA RETENTION

We retain your personal data only for as long as necessary to fulfill the purposes described above, or as required by law.

Retention periods depend on the type of data but will not exceed 12 months unless you become a client.

9. YOUR RIGHTS UNDER GDPR

Depending on your location, you have the following rights:

• Access: Obtain confirmation of whether we process your personal data and a copy of that data.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure (“Right to be Forgotten”): Request deletion of your personal data.
• Restriction: Request limitation of processing in certain circumstances.
• Portability: Receive your data in a structured, commonly used format and request transfer to another controller.
• Objection: Object to processing based on legitimate interests or for direct marketing.
• Withdrawal of Consent: Withdraw consent at any time where processing is based on consent.

To exercise these rights, contact us at Manager@UnderstoryFund.com.

You also have the right to lodge a complaint with your local Data Protection Authority (for example, the [Insert Supervisory Authority, e.g., “CNIL in France”]).

10. DATA SECURITY

We implement appropriate technical and organizational measures to protect your personal data.

However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

11. THIRD-PARTY LINKS

Our Site may contain links to third-party websites.

We are not responsible for the privacy practices or content of those external sites.

12. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time.

We will post the updated version on this page with a revised “Last Updated” date and, where required, seek your consent to material changes.