Effective Date: August 19, 2025 | Last Updated: March 18, 2026
CONFIDENTIAL | FOR AUTHORIZED RECIPIENTS ONLY | ACCREDITED INVESTORS
The data controller responsible for the collection, processing, storage, and protection of your personal information is Correa Alonso Asset Management LLC ("CAAM" or the "Manager"), a Delaware limited liability company acting as the investment manager and managing member of Correa Public Investments LLC (the "Company," the "Fund," or "CPI"), a Delaware limited liability company organized and operated as a manager-managed private investment fund. Christopher Correa, Managing Partner, serves as the designated privacy officer responsible for overseeing compliance with this Privacy Policy.
This Privacy Policy (this "Policy") describes how the Company and the Manager collect, use, process, disclose, retain, protect, and dispose of personal information and nonpublic personal information ("NPI") in connection with all aspects of the Fund's operations. This Policy applies to the following services, platforms, and interactions (collectively, the "Platform"):
This Policy applies to all individuals and entities that provide personal information to the Company or the Manager, including:
This Policy is designed to comply with applicable U.S. federal and state privacy and data protection laws and regulations, including: Regulation S-P under the Securities Exchange Act of 1934 (to the extent applicable); the Gramm-Leach-Bliley Act ("GLBA") and its implementing regulations; the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA"); the Washington My Health My Data Act and the Washington Privacy Act (to the extent applicable); the USA PATRIOT Act and Bank Secrecy Act AML and KYC record-retention requirements; the Apple Developer Program License Agreement and App Store Review Guidelines; the Google Play Developer Distribution Agreement and Google Play Data Safety requirements; and such other federal, state, and international privacy laws as may be applicable from time to time.
The Company and the Manager collect the following categories of personal information in connection with Fund operations and Platform use. Each category is mapped to the Apple App Store privacy label taxonomy and Google Play Data Safety categories for transparency and compliance.
Apple Privacy Label: Name, User ID, Physical Address. Google Data Safety: Personal info (Name, Email address, Personal identifiers).
Apple Privacy Label: Email Address, Phone Number, Physical Address. Google Data Safety: Personal info (Address, Phone number, Email address).
Apple Privacy Label: Financial Info (Payment Info, Other Financial Info). Google Data Safety: Financial info (Purchase history, Other financial info).
The Manager processes personal information on the following legal bases:
Contractual Necessity — Identity, Contact, Financial data. Processing necessary to perform the Subscription Agreement, Operating Agreement, and Fund administration obligations, including capital account maintenance, NAV calculation, subscription processing, and redemption processing.
Legal Obligation — Identity, Tax/Regulatory, Compliance data. Processing required to comply with applicable securities laws (Reg D, Securities Act, Exchange Act), tax laws (IRC, Form 1065, K-1 reporting), AML laws (USA PATRIOT Act, Bank Secrecy Act), OFAC sanctions screening, FATCA, and state regulatory requirements.
Legitimate Interest — Technical, Usage, Communications data. Processing necessary for the security of the Platform, fraud prevention, internal audit, recordkeeping, improvement of services, and protection of the legal rights of the Company and the Manager. The Manager has conducted a balancing test to ensure that these legitimate interests do not override your fundamental rights.
Consent — As applicable. Where required by law, the Manager obtains your explicit consent before processing personal information for purposes not covered by the bases above. You may withdraw consent at any time by contacting the Manager, without affecting the lawfulness of processing conducted prior to withdrawal.
The Manager does not sell personal information. The Manager does not share personal information with third parties for marketing purposes. The Manager does not share personal information for cross-context behavioral advertising. The Manager does not engage in data brokerage.
Personal information may be disclosed to the following categories of recipients, solely for the purposes described below and subject to strict confidentiality obligations:
Interactive Brokers LLC (Custodian) — Identity, Contact, Financial, Tax data. Custody of Fund assets, trade execution and settlement, account administration, SIPC coverage, and regulatory reporting.
Legal Counsel — Identity, Contact, Financial, Compliance, Communications data. Legal advice, regulatory compliance guidance, contract preparation and review, dispute resolution, and litigation defense.
Accountants and Auditors — Identity, Financial, Tax data. Preparation of annual financial statements, annual audit (when engaged), Form 1065 preparation, Schedule K-1 preparation, and tax advisory services.
Fund Administrator (if engaged) — Identity, Contact, Financial data. Independent NAV calculation, investor accounting, subscription and redemption processing, and periodic reporting.
AML/KYC Service Providers — Identity, Compliance data. Identity verification, sanctions screening, PEP screening, adverse media screening, and ongoing monitoring.
Regulatory Authorities — As required. Compliance with SEC, IRS, OFAC, FinCEN, state securities regulators, and law enforcement as compelled by law, subpoena, court order, or regulatory examination.
All third-party service providers are subject to written confidentiality agreements or are otherwise bound by professional duties of confidentiality. The Manager conducts periodic reviews of service provider data handling practices.
The Manager retains personal information for the minimum period necessary to fulfill the purposes for which it was collected, to comply with applicable legal and regulatory retention requirements, and to protect the Company's legal interests.
Subscription Documents & Investor Questionnaires: Duration of membership plus 5 years following final redemption or termination. (Reg D record-retention; state securities laws; statute of limitations for securities fraud claims.)
Accredited Investor Verification Records (Rule 506(c)): Duration of membership plus 5 years following final redemption. (Rule 506(c) reasonable steps verification requirement; SEC examination guidelines.)
Capital Account Records, Transaction History, and NAV Data: Duration of membership plus 7 years following final redemption. (IRC Section 6501; Treasury Regulation record-retention requirements.)
Tax Documentation (W-9, W-8, K-1 records, Form 1065 data): Duration of membership plus 7 years. (IRC Section 6501; IRS record-retention guidance; BBA Audit Rules.)
AML/KYC Records: 5 years following termination of investor relationship. (USA PATRIOT Act Section 326; FinCEN CDD Rule; Bank Secrecy Act.)
Correspondence and Communications: 5 years following the date of communication.
Technical and Usage Logs: 2 years from date of collection.
Cookies and Session Data: Session duration only (not persisted).
Upon expiration of the applicable retention period, personal information will be securely destroyed using industry-standard data disposal methods, including secure electronic deletion (multi-pass overwrite or cryptographic erasure) and cross-cut shredding for physical documents.
The Manager maintains a comprehensive information security program designed to protect personal information from unauthorized access, use, disclosure, alteration, or destruction.
No method of electronic transmission or data storage is completely secure. In the event of a data breach, the Manager will: (i) promptly investigate and take reasonable steps to contain and remediate the breach; (ii) notify affected individuals as required by applicable law, including within 72 hours where required by state breach notification statutes; and (iii) notify applicable regulatory authorities as required by law.
The Platform uses only the following categories of cookies:
Session Cookies — Maintain authenticated session state, prevent session hijacking, and enable navigation between secure pages. Session only; deleted when browser is closed. No third party.
Authentication Cookies — Remember authenticated status across page loads within a single session and facilitate multi-factor authentication workflows. Session only. No third party.
Security Cookies — Detect and prevent cross-site request forgery (CSRF), brute-force login attempts, and other security threats. Session only or up to 24 hours. No third party.
Because the Platform uses only essential session, authentication, and security cookies, there is no opt-out mechanism for these cookies — they are strictly necessary for the secure operation of the investor portal. The Platform does not respond to Do Not Track ("DNT") browser signals because no tracking occurs.
Subject to applicable law and the Manager's legal and regulatory retention obligations, you may exercise the following rights:
9.1 Right of Access. You may request a copy of the personal information the Manager maintains about you. The Manager will respond to verified access requests within 45 calendar days, with one 45-day extension if reasonably necessary.
9.2 Right of Correction. You may request correction of inaccurate or incomplete personal information. Corrections to tax-related information (SSN, TIN, W-9/W-8) may require submission of updated forms and may trigger amended filings.
9.3 Right of Deletion. You may request deletion of personal information that is no longer necessary for the purposes for which it was collected. The Manager will comply except where retention is required by law or regulation (AML/KYC records: 5-year minimum; tax records: 7-year minimum; subscription documents: 5-year minimum).
9.4 Right to Data Portability. Where technically feasible, you may request a copy of your personal information in a structured, commonly used, machine-readable format (such as CSV or JSON).
9.5 Right to Opt-Out of Sale. The Manager does not sell personal information and has never sold personal information. No opt-out mechanism is required.
9.6 Right to Non-Discrimination. The Manager will not discriminate against you for exercising any of your privacy rights.
9.7 How to Exercise Your Rights. Submit a written request to the Manager at ask@correafunds.com or by mail to the address specified in Section 14. The Manager will verify your identity before processing any request.
If you are a California resident, the following additional disclosures are provided pursuant to the CCPA:
10.1 Categories of Personal Information Collected: Identifiers; Financial information; Professional or employment-related information; Internet or other electronic network activity information; and Sensitive personal information (as defined by California Civil Code Section 1798.140).
10.2 Business Purposes for Collection: Subscription processing and accredited investor verification; Fund administration and capital account maintenance; tax reporting and K-1 preparation; regulatory compliance (AML, KYC, OFAC, FATCA); investor communications; and Platform security.
10.3 Third Parties: The categories of third parties with whom the Manager shares personal information are described in Section 5. No personal information has been sold. No personal information has been shared for cross-context behavioral advertising.
10.4 Sensitive Personal Information: Collected solely for subscription processing, accredited investor verification, tax reporting, and regulatory compliance. The Manager does not use sensitive personal information for any purpose other than those expressly permitted under CCPA Section 1798.121.
10.6 Your CCPA Rights: California residents have the right to know, request deletion, request correction, opt out of sale/sharing (not applicable), and limit use of sensitive personal information (already limited). The Manager will not discriminate against you for exercising any CCPA right.
The Platform and the Fund's services are not directed to, designed for, or intended for use by individuals under the age of 18. The Company does not knowingly collect, solicit, or process personal information from minors. If the Manager becomes aware that personal information has been inadvertently collected from an individual under the age of 18, such information will be promptly deleted and the individual's account (if any) will be terminated. If you believe that a minor has provided personal information to the Company, please contact the Manager immediately at ask@correafunds.com.
The Company and the Manager are based in the United States. All personal information collected through the Platform is stored and processed in the United States. If you are accessing the Platform from outside the United States, you acknowledge and consent to the transfer of your personal information to the United States, where data protection laws may differ from those of your home jurisdiction. The Manager will take reasonable steps to ensure that your personal information receives an adequate level of protection in accordance with this Policy. Non-U.S. investors should consult their own legal advisors regarding the implications of cross-border data transfers applicable to their jurisdiction.
The Manager reserves the right to update, amend, or replace this Policy at any time. Material changes will be communicated through one or more of the following methods: (i) posting the revised Policy on the Company's website with an updated "Last Updated" date; (ii) publishing a notice on the investor portal; (iii) sending a direct notification via email; or (iv) providing notice through the mobile application (if applicable). Continued use of the Platform following notification of material changes constitutes acceptance of the revised Policy. If you do not agree with any changes, you should discontinue use of the Platform and contact the Manager to discuss your options.
For all questions, concerns, requests, or complaints regarding this Privacy Policy or the handling of your personal information:
Correa Public Investments LLC
Correa Alonso Asset Management LLC
Attention: Christopher Correa, Managing Partner — Privacy Inquiries
Email: ask@correafunds.com
Phone: 206-430-3325
Web: correafunds.com
The Manager will acknowledge receipt of your inquiry within five (5) business days and will provide a substantive response within a reasonable timeframe consistent with applicable law. If you are not satisfied with the Manager's response, you may have the right to lodge a complaint with the applicable state attorney general or other regulatory authority.
This Privacy Policy is provided in connection with the offering of membership interests in Correa Public Investments LLC pursuant to Regulation D, Rules 506(b) and 506(c), under the Securities Act of 1933. It is intended solely for accredited investors and authorized recipients. The membership interests described herein have not been registered under the Securities Act of 1933 or any state securities laws. Neither the SEC nor any state securities commission has approved or disapproved of these securities or passed upon the accuracy or adequacy of this document.
© 2025–2026 Correa Alonso Asset Management LLC. All rights reserved.