Data privacy is a primary concern for each of StepStone Group LP (“SSG”), StepStone Group Real Assets LP (“SIRA”), StepStone Group Real Estate LP (“SRE”) and Swiss Capital Alternative Investments AG (“SCAI”) together with their affiliates and related entities (collectively, “StepStone”). This data privacy notice (the “Notice”) details StepStone’s practices for collecting, using, and disclosing the personal information of clients and others, to both affiliates of SSG, SIRA, SRE and SCAI as applicable, and nonaffiliated third parties. Recipients of this Notice include, among others, current clients and investors, prospective clients, visitors to our websites, former clients, employees of managers with whom StepStone has conducted business, and employees of StepStone or any of StepStone’s affiliates (each a “Notice Recipient”). For purposes of this Notice, an affiliate is an entity that (i) controls SSG, SIRA, SRE or SCAI, (ii) is controlled by SSG, SIRA, SRE or SCAI, or (iii) is under common control with SSG, SIRA, SRE or SCAI. Nonaffiliated third parties are parties who are not affiliates of any of SSG, SIRA, SRE or SCAI.
Confidentiality of Personal Information
StepStone maintains the confidentiality of personal information that a Notice Recipient provides to it. StepStone maintains reasonable physical, electronic and procedural safeguards to guard a Notice Recipient’s personal information. All third parties that handle information must agree to follow the standards for confidentiality that StepStone has established, and are obligated to use personal information only in accordance with the purpose for which it is shared. In addition, all people who work for StepStone are trained to handle a Notice Recipient’s information properly in order to maintain its security, and only employees who need to know personal information about a Notice Recipient to provide services to such Notice Recipient have access to such information.
Categories of Personal information that StepStone Collects
StepStone collects personal information about Notice Recipients from the following sources: (i) information it receives from Notice Recipients on applications or other forms, including contact forms and application forms; (ii) information about Notice Recipients’ transactions with StepStone, its affiliates, or others; and (iii) information collected automatically from website visitors.
StepStone is a data controller within the meaning the General Data Protection Regulation (“GDPR”), the Swiss Federal Act on Data Protection (“FADP”) and other applicable data protection legislation in force in the European Economic Area (“EEA”), and a business within the meaning of the California Consumer Privacy Act of 2018 (“CCPA”) and undertakes to hold any personal information provided in accordance with EEA data protection legislation and the CCPA.
Use of Your Personal Information
Personal information will be used by StepStone for the following purposes:
- to respond to and communicate with you;
- to provide the services you request;
- to manage and administer holdings in StepStone managed or advised funds, separately managed accounts, advisory engagements and any related business relationships (and, in each case, the investments made pursuant thereto) on an ongoing basis in accordance with the terms agreed between a Notice Recipient and SSG, SIRA, SRE or SCAI, as applicable;
- to provide user and technical support;
- to carry out statistical analysis and market research; and
- to comply with legal and regulatory obligations applicable to the Notice Recipient, StepStone or its managed or advised funds, separately managed accounts, advisory engagements or any related business relationship with the Notice Recipient from time to time, including applicable anti-money laundering and counter terrorist financing legislation, investor qualification legislation and tax legislation.
To understand our practices regarding information that is collected automatically from visitors to our website, please review our Cookie Consent Policy.
We only use personal information in connection with StepStone’s legitimate business interests and accordingly Notice Recipients’ specific consent is not required.
Job Applicants
If you apply for a job with us, we will collect additional information in connection with your application. This may include:
- Name and contact information;
- Username and password;
- Work authorization status;
- Resume, CV, cover letter, work experience, and education information;
- Skills;
- Professional and work-related licenses, permits, and certifications held;
- Reference-related information; and
- Any other information that is publicly available or that you elect to provide to us (e.g., current salary, expected salary).
Such information may be collected from you directly, from your references, from your prior employers, and from your places of education. We will only use this information to evaluate your candidacy, including by processing your application, assessing your qualifications, corresponding with you, and complying with legal obligations.
Disclosure of Personal information to Affiliates
StepStone generally may share all of a Notice Recipient’s personal information with StepStone’s affiliates, provided that such affiliates will be obligated to keep such personal information confidential to the same extent as StepStone. StepStone shares information with its affiliates in order to serve its Notice Recipients better. If a Notice Recipient prefers that StepStone not disclose personal information about such Notice Recipient to its affiliates, such Notice Recipient may opt out of those general disclosures; that is, such Notice Recipient may direct StepStone not to make such disclosures (other than disclosures permitted or required by applicable law or otherwise permitted by StepStone’s privacy policy). However, notwithstanding any such opt-out, StepStone will be permitted to disclose personal information to its affiliates to the extent necessary or appropriate for such affiliates to perform services for the benefit of the Notice Recipient.
Disclosure of Personal information to Non-Affiliates
StepStone does not sell or market a Notice Recipient’s personal information to nonaffiliated third parties. StepStone’s intent is to respect the Notice Recipients’ expectations that their personal information will be kept confidential. However, in order to serve the Notice Recipients better, StepStone will disclose personal information to nonaffiliated third parties (including service providers to StepStone) to the extent necessary or appropriate for such third parties to perform services for the benefit of the Notice Recipient. In addition, StepStone only shares personal information with unaffiliated third parties if StepStone believes that such personal information will be kept confidential by such third parties after such disclosure, and that the third parties will use the personal information only for the purposes identified by contract between StepStone and the nonaffiliated third party.
StepStone may also disclose information:
- In connection with any merger, sale of stock or assets, financing, acquisition, divestiture, or dissolution of all or a portion of our business; and
- If we believe that disclosure is reasonably necessary (a) to comply with any applicable law, regulation, legal process or governmental request; (b) to enforce or comply with our Terms of Use or other applicable agreements or policies, (c) to protect our rights or property, or the security or integrity of our services, or (d) to protect us, users of our services or the public from harm or potentially prohibited or illegal activities.
Except as required by applicable law and described in this privacy notice, StepStone will not share any other personal information about a Notice Recipient with its affiliates or nonaffiliated third parties.
Personal information of Former Investors and Prospective Clients
This Notice and StepStone’s policy regarding treatment of personal information of Notice Recipients also apply to former clients, business prospects, potential clients and current and former employees.
Disclosure of Personal information outside the EEA (excluding Switzerland)
Personal information may be transferred to countries which may not have the same or equivalent data protection laws as that required under EEA data protection legislation. Any such transfer will be made in compliance with applicable data protection legislation, and appropriate measures are in place to ensure this, such as entering into Model Contractual Clauses (as published by the European Commission). For more information on the means of transfer of data or a copy of the relevant safeguards, please contact us at privacy@stepstoneglobal.com.
Pursuant to EEA data protection legislation, investors have the right to object to processing of personal information and a number of other rights which may be exercised in certain circumstances, i.e.:
- the right of access to personal information held;
- the right to amend and rectify any inaccuracies in personal information held;
- the right to erase personal information held;
- the right to data portability of personal information held; and
- the right to request restriction of the processing of personal information
These rights will be exercisable, subject to limitations as provided for in EEA data protection legislation. Any Notice Recipient may make a request to StepStone to exercise these rights by contacting us at privacy@stepstoneglobal.com.
Rights for California Residents
The California Consumer Privacy Act of 2018, California Civil Code Sections 1798.100 et seq. (CCPA) additionally affords data protection rights to persons who are California residents, following a verifiable request, and under certain circumstances, i.e.:
- the right of access—twice in a 12-month period, free of charge—to the 12-month period prior to the request, the categories and specific pieces of personal information StepStone has collected about the person, the categories of sources from which the personal information is collected, the business purpose for collecting the personal information, and the categories of third parties with whom StepStone has shared personal information; and
- the right to delete personal information under certain circumstances.
Such requests may be made as described in the below Contact Us section. StepStone does not discriminate against our persons on the basis of their exercising any of their rights afforded by the CCPA, which is further in accordance with California residents’ rights under that title.
Retention of Personal Information
Please note that personal information may be retained by StepStone for the duration of a Notice Recipient’s investment or engagement with StepStone, and afterwards in accordance with StepStone’s legal and regulatory obligations, including but not limited to StepStone’s record retention policy.
Links to Other Sites
Our websites may contain links to other sites. Please be aware that we are not responsible for the content or privacy practices of such other sites. We encourage our users to be aware when they leave our site and to read the privacy statements of any other linked sites that collect personal information.
Contact Us
For queries, requests or comments in respect of this Notice, or the way in which StepStone uses personal information, or if you need to access the policy in an alternative format due to a disability, please contact us at privacy@stepstoneglobal.com, fill out our Contact Us form available on our website, or call +1-888-995-0350. StepStone will verify your identity using at least two data points. You may also authorize an agent to submit a request on your behalf, so long as you provide the authorized agent written permission to request on your behalf, and your authorized agent is able to verify their identity with us.
Note that Notice Recipients have the right to lodge a complaint with the appropriate regulator.
Changes to Privacy Policy
StepStone may modify its privacy policy at any time. If we make any changes to this Privacy Policy, we will provide notice of such changes, as appropriate (e.g., on our website or by an email notification to the address you have provided). For administrative changes, we may provide indication in our Privacy Policy by updating the “Last Updated” date at the top of this Policy.
