PRIVACY POLICY

Last Modified Date: September 30, 2025

Griffin Capital Company, LLC. (collectively, “Griffin Capital”, “we”, “our”, or “us”) is committed to protecting the privacy of our customers and others interested in our business and investment services, including via interactions with our website (the “Site”, collectively offering, the “Services”).

This Privacy Policy (“Privacy Policy”) applies to information from the Services that collect personal information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, as defined by applicable privacy laws (“Personal Information”). Personal Information does not include: (i) publicly available information; (ii) deidentified or aggregated consumer information, as permitted under applicable laws; or (iii) personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (“FRCA”) and the Gramm-Leach-Bliley Act (“GLBA”). For more information on information collected, processed, or disclosed pursuant to the GLBA and its implementing regulations, please refer to our GLBA Privacy Notice https://www.griffincapital.com/privacy-policy/.

By accessing and using the Site containing a link to this Privacy Policy, applying for the Services, or otherwise providing us with Personal Information, you agree to the terms and conditions of this Privacy Policy. If you do not agree to the terms and conditions of this Privacy Policy, then please do not provide us with your Personal Information. Please note, however, that if you choose to limit the information that you provide to us while using the Services, you may not be able to use or participate in certain features of the Services.

1.    Revisions and Updates to this Privacy Policy

We reserve the right to revise or update this Privacy Policy at any time, and you should periodically read the Privacy Policy to learn of any revisions or updates. If the revision or update is material, we will provide you notification via email or banner on the Site; however, for non-material revisions or updates, we will notify you by posting the revised or updated Privacy Policy and its “Last Modified Date” on the Site. Using the Services thereafter constitutes your agreement to and acceptance of the Privacy Policy and its revisions or updates.

2.    The Types of Personal Information That We Collect

Griffin Capital collects Personal Information regarding customers who visit the Site, initiate an application process, register for marketing or communication services, or submit inquiries about the Services (collectively, “you”, “your”). We collect Personal Information about you in various ways, including:
• Directly from you;
• Automatically, when you use the Site; and
• From third parties.

Personal Information from you directly or via third parties.

We collect Personal Information directly from you, for example when you submit an inquiry via the Site or initiate an application for the Services.

We collect Personal Information from third parties including our Affiliates and Subsidiaries, data providers, and financial bureaus where permitted by law and in the course of providing the Services you request. You agree that the third-party providers of data, not Griffin Capital, are responsible for maintaining your information with proper and sufficient accuracy and authority in accordance with all governing laws and regulations. We make no effort to verify any information for any purpose, including accuracy, legality, or non-infringement that we properly receive from third parties.

We may collect the following categories from the above-mentioned sources:

• Identifiers, including name, alias, telephone number, postal address, unique personal identifier, online identifier, email address, account name, financial and bank information, social security number, driver’s license number, passport number;
• Information Listed in the California Customer Records Statute, including name, signature, postal address, telephone number, passport number, driver’s license or state identification card number, education, employment, employment history, bank account number, credit and/or debit card number, and other financial or investment information, medical information;
• Protected Classifications under California or Federal Law, including age, national origin, citizenship and marital status;
• Professional or Employment Information, including current or past job history; and
• Sensitive Personal Information, including social security number, driver’s license number, passport number, national origin and citizenship.

Special Category Information

Some of the information that we may collect as a result of providing investment solutions is particularly sensitive (e.g., social security number, driver’s license number, passport number, national origin and citizenship). We only collect this information as provided by or consented by you.

Such sensitive information is only shared for the purpose of providing the Services you request or as consented for and will not be shared or used by us for any other purposes.

Automatically, when you use the Services

We may use cookies, tags, web pixels, and similar technologies to automatically collect information on the Site. Information within this section describes our use of these technologies and your ability to control the use of these technologies.

• Cookies. Cookies are small web files that a website or its provider transfers to your device’s hard drive, through your web browser, that enables the site’s or provider’s system to recognize your browser and remember certain information. “First-party cookies” are cookies set by us on the Site. “Third-party cookies” are cookies set by other companies whose functionality is embedded into the Site (for example, those set by Google). Generally, we may use first-party and third-party cookies for the following purposes: to make the Site function properly; to provide a secure browsing experience during your use of the Site; to collect passive information about your use of the Site; to measure how you interact with our marketing campaigns; to help us improve the Site; and to remember your preferences for your convenience.
• Web Pixels. To see how successful our marketing campaigns or other goals of the Site are performing, we may use conversion pixels, which fire a short line of code to tell us when you have clicked on a particular button or reached a particular page. We may also use web pixels to analyze usage patterns on the Site. The use of a pixel allows us to record that a particular device, browser, or application has visited a particular webpage.
• Analytics. We may use third-party service providers to monitor and analyze the use of the Site, such as Google Analytics. Such service providers often have their own separate privacy practices.
• Cross-Device Tracking. We and our providers may use the information we collect about you within the Site and on other third-party websites and services to help us and these third parties identify other devices that you use (e.g., a mobile phone, tablet, other computer, etc.) to interact or engage with us or the Site.
• Behavioral Remarketing. We may also use remarketing services to advertise on third-party websites to you after you visited the Site. For this purpose, visitors are grouped by certain actions on the Site, e.g., by duration of a visit. This enables us to understand your preferences and to show you personalized advertising even if you are currently surfing on another website that also participates in the same advertising network. We may utilize Pardot and similar ad networks.
• Java Script. Pages of the Site may also use Java scripts, which are code snippets embedded in various parts of websites and applications that facilitate a variety of operations including accelerating the refresh speed of certain functionality or monitoring usage of various online components; entity tags, which are HTTP code mechanisms that allow portions of websites to be stored or “cached” within your browser to accelerate website performance; and HTML5 local storage, which allows data from websites to be stored or “cached” within your browser to store and retrieve data in HTML5 pages when the website is revisited.
• Other Tracking Technologies. We may also use tracking technologies to collect “clickstream” data, such as the domain name of the service providing you with internet access, your device type, IP address used to connect your computer to the internet, your browser type and version, operating system and platform, the average time spent on the Site, pages viewed, content searched for, access times and other relevant statistics, and assign unique identifiers to the device or other credentials you use to access the Site for the same purposes.
• Do Not Track. Some browsers have a “Do Not Track” (DNT) feature that lets you tell websites and online services that you do not want to have your online activities tracked. Such browser features and industry standards are not uniform. As such, we do not monitor or respond to DNT browser requests. If a standard is adopted that we must follow in the future, then we will inform you about our updated practice in a revised version of this Policy.
• Location Information. You may be able to adjust the settings of your device so that information about your physical location is not sent to us or third parties by (a) disabling location services within the device settings; or (b) denying certain websites or mobile applications permission to access location information, by changing the relevant preferences and permissions in your device or browser settings.
• Your Choices. Your browser may provide you with the option to refuse some or all browser cookies. You may also be able to remove cookies from your browser. You can exercise your preferences in relation to cookies on the Site by taking steps outlined below.
• First-Party Cookies. You can use the browser with which you are viewing the Site to enable, disable or delete cookies. To do this, follow the instructions provided by your browser (usually located within the “Help”, “Tools” or “Edit” settings). Please note, if you set your browser to disable cookies, you may not be able to access certain secure areas of the Site. Also, if you disable cookies, other parts of the Site may not work properly. You can find more information about how to change your browser cookie settings at https://www.allaboutcookies.org.
• Third-Party Cookies. If you wish to opt-in or opt-out of third-party advertising networks and similar entities that use advertising cookies, then please visit https://www.aboutads.info/choices. For more information about third-party advertising networks and similar entities that use these technologies, please see https://www.aboutads.info/consumers.
• Google Analytics. We use Google Analytics on the Site to help us analyze traffic and improve services. For more information on Google Analytics’ processing of personal information, please see https://www.google.com/policies/privacy/partners/. You may opt out of the use of Google Analytics here: https://tools.google.com/dlpage/gaoptout.
• Unsubscribing from Marketing Communications. If you do not want us to use your email account to send you marketing emails or non-transactional promotional materials, please directly click on the unsubscribe link at the bottom of any of our email messages to you.

3.    Purpose of Collection

Griffin Capital processes Personal Information for the following purposes:
• Provide the Services. We may use your Personal Information to provide the Services or any other products or services you may request from us.
• Monitor the Services. We collect your Personal Information for monitoring purposes to help us diagnose problems with our servers, administer and troubleshoot the Services, calculate usage levels, analyze industry standards, and analyze transactions, trends, and statistics regarding the use of the Services.
• Personalize your Experience. We may collect your Personal Information to leverage analytics and retargeting to personalize your experience.
• Respond to Inquiries and Fulfill Requests. We may use your Personal Information to respond to your inquiries and to fulfill your requests for information.
• Communicate with You. We may use your Personal Information to send you marketing information about the Services and other items that may be of interest to you.
• Improve the Services. We may use your Personal Information to make the Site more stable and user-friendly, to analyze service issues, improve the design and content of the Services, analyze how the Services are used, offer new services, and to develop new marketing programs relating to the Services.
• Customer Service. We may use your Personal Information when contacting you regarding customer service, the Services, or in response when you provide feedback. We may also use your information to send administrative emails regarding the Services or to inform you of any changes to this Privacy Policy, our Terms, or our third-party partner’s Terms.
• Support Business Operations. We may use your Personal Information to support our internal and business operations, including marketing, security, and advertising.
• Enforce Agreements. We may use your Personal Information to enforce separate agreements between you and us, enforce this Privacy Policy, our Terms and Conditions, or our third-party partner’s terms, or in connection with a transaction with a similar effect.
• Fulfill Other Purposes. We may use your Personal Information to fulfill: (a) any other purpose for which you provide it; (b) any legal or regulatory requirements and any of our internal policies; (c) other purposes disclosed at the time of collection; (d) any other purpose with your consent; and (e) any other purposes set forth in this Privacy Policy.

4.    Disclosure of Personal Information

We do not sell, share, rent, or otherwise disclose the Personal Information collected from the Services or on the Site, to third parties for monetary or other valuable consideration, unless otherwise stated below or with your consent or your agent’s consent on your behalf:
• Service Providers & Contractors. We may share your Personal Information with service providers and contractors to perform tasks on our behalf and to assist us in providing the Services, including but not limited to internal and business operations, security, identity verification, and related services. Service providers and contractors may use the information only as necessary to provide the services to us and are contractually required to keep your information confidential and secure.
• Investment and Business Partners. We may share your Personal Information with our investment and business partners to provide you with the Services you have requested. We may also share your personal information to business partners with whom we jointly offer the Services.
• Advertising & Analytics Partners. We may share your personal information with third-party advertising and analytics partners, including without limitation your contact information with entities that perform marketing or data aggregation services on our behalf, or with which we or an affiliate has joint marketing arrangements. We may share Personal Information, including without limitation your device information, location, usage data, and IP address, to analytics-based technologies to assist with personalization, advertising, and marketing. These technologies capture how you interact with the Site through behavioral metrics to improve and market our underlying services, products, and Site. These advertising and analytics partners may use first- and third-party cookies together to inform, optimize, and serve ads based on your past visits to this Site. You can opt-out of these services using their Ads Preferences Manager or you can use the methods described in the Your Choices section above.
• Authorized Representatives. If another individual is managing your account or access to the Services on your behalf (for example, a wife managing the account of her husband), as authorized by you or as a personal representative under applicable law, that person can view all Personal Information about you in the Services.
• In the Event of Merger, Sale, Divestitures or Change of Control. We may transfer or assign Personal Information to an entity that acquires or is merged with us as part of a merger, acquisition, sale of ownership or assets, or other change of control.
• Other Third Parties with your Consent. We may disclose Personal Information to other third parties to whom you or your agents authorize us to disclose your personal information in connection with the Services we provide to you.
• Other Disclosures. We may disclose your Personal Information if we have a good faith belief that disclosure of such information is helpful or reasonably necessary to: (i) comply with any applicable law, regulation, legal process or governmental request; (ii) enforce our contracts with you, including investigations of potential violations thereof; (iii) detect, prevent, or otherwise address fraud or security issues; or (iv) protect against harm to our, your, or third parties’ rights, property, or safety.

We may share de-identified and/or aggregate analytics with third-party partners about how users interact with the Services, including usage patterns for certain programs, content, services, advertisements, promotions, and/or functionality available through the Services.

5.    Transfer of Personal Information to a Third Country

If you do not reside in the United States and provide Personal Information to us, please note that your Personal Information will be transferred, processed, collected, used, accessed and/or stored in the United States and subject to U.S. laws. The laws in the United States may not provide the same protections for your Personal Information as the jurisdiction in which you are located. Do not provide your Personal Information to us if you do not want this information to be transferred or processed outside of your country, or if the laws in your country restrict such transfers.

6.    Retention Period

We keep your Personal Information only as long as necessary to provide you with the Services and for legitimate and essential business purposes, such as maintaining the performance of the Services, making data-driven business decisions about new features and offerings, complying with our legal obligations, and resolving disputes.

7.    Third-Party Site

The Services may link to third-party websites, online services, mobile applications and/or contain advertisements from third parties that are not affiliated with us and which may link to other websites, services, or applications. Please be aware that we are not responsible for the privacy or practices of other websites or third parties, including those using the Griffin Capital branding. We do not make any guarantee regarding those third-party websites, services, or applications, and we are not liable for any loss or damage caused by the use of such sites. Any data collected by third parties is not covered by this Privacy Policy. You should review the policies of the third parties and contact them directly if you have any questions about their services or practices.

8.    Confidentiality and Security

We maintain appropriate safeguards using industry standard technology to heighten the security, accuracy, and privacy of any Personal Information we have collected, and we have put in place reasonable precautions to protect information from loss, alteration, and misuse. While we implement these measures, please note that 100% security is not possible, and we cannot guarantee that the security measures we have in place to safeguard Personal Information will never be defeated or fail, or that those measures will always be sufficient or effective.

9.    Minors

We do not knowingly collect or solicit personal information from children under the age of 16 without consent from a guardian or parent. By using the Site or Services, you represent that you are at least 16 years old or have consent from a guardian or parent. If we become aware that we have inadvertently received or collected Personal Information from a user of the Site who is under the age of 16, we will attempt to immediately delete that information from our files and records. If you believe a child who is under the age of 16 has provided us with Personal Information without consent from a parent or guardian, please contact us using the information below.

10.   United States Privacy Rights

This section describes state specific consumer rights afforded to residents of those states who have enacted comprehensive privacy laws (“State Privacy Laws”).  Not all of the State Privacy Laws are effective as of the date of this Privacy Statement, and several do not apply to us; however, even where we are not subject to a particular State Privacy Law, we will endeavor to honor applicable privacy rights requests to the extent we are able under the circumstances, but this is a courtesy only and does not otherwise subject us to or make us liable under these laws, to the extent permitted. Any terms defined in the applicable State Privacy Laws that we use here have the same meaning as the applicable State Privacy Law.

Most of our data collection, use, and sharing practices are governed by our GLBA Notice https://www.griffincapital.com/privacy-policy/; however, certain State Privacy Laws may apply to the Services for which a continuing customer relationship has not been formed or are otherwise not subject to the GLBA.

Categories of Personal Information Collected & Shared

During the 12-month period prior to the effective date of this Privacy Policy, we may have shared or disclosed the following categories of Personal Information about you for a business or commercial purpose with certain categories of third parties, as described below:

California Shine the Light

Under California’s “Shine the Light” law, California residents have the right to request in writing from businesses with whom they have an established business relationship, (a) list of the categories of Personal Information, such as name, email and mailing address and the type of services provided to the customer, that a business has disclosed to third parties (including affiliates that are separate legal entities) during the immediately preceding calendar year for the third parties’ direct marketing purposes; and (b) the names and addresses of all such third parties. To request the above information, please contact us as directed in the Contact Us section below with reference to California Disclosure Information.

Sales and Sharing of personal information; Use for Targeted Advertising

Certain state laws, including the California Consumer Privacy Act, define “sale” as disclosing or making available personal information to a third-party in exchange for monetary or other valuable consideration, and “sharing” or “targeted advertising” as disclosing or making available personal information to a third-party for purposes of cross-contextual behavioral advertising.

We sell and “share” or use for targeted advertising the following categories of personal information: name, email, address, and Usage Data. We disclose these categories to our Advertising & Analytics Partners (as described above) for purposes of marketing and advertising. We do not sell or share or use for targeted advertising personal information about individuals we know are under age 16. For more information regarding your opt-out rights, see the below Your Privacy Rights and Choices.

Your Privacy Rights and Choices

Residents of states with generally applicable privacy laws may have the following rights regarding their personal information, subject to certain exceptions and qualifications under their respective state laws.

• Access and Data Portability. You have the right to request details about the personal information we have collected about you, such as whether we have collected personal information about you, the categories of sources, the purposes for which we have collected the personal information, the categories of recipients, and the specific pieces of personal information we have collected. You may also have the right to receive a copy of your personal information in a readily usable format.
• Correction. You may have the right to request we correct incorrect or inaccurate personal information, subject to restrictions regarding the determination of accuracy of the existing personal information.
• Deletion. You may have the right to request deletion of your data unless an exception applies.
• Opt-Out of Sale, Sharing, or Targeted Advertising. You have the right to opt-out of “sales” and “sharing” of your personal information, and to opt-out of the use of your personal information for “targeted advertising” as those terms are defined under applicable state privacy laws.
• You have the right to opt-out of “sales” and “sharing” of your personal information or use for targeted advertising by using an opt-out preference signal. If the Website detects that your browser or device is transmitting an opt-out preference signal, such as the “global privacy control”—or GPC — signal, we will opt that browser or device out of the use of cookies or other tools on our site that result in a “sale” or “sharing” or use for targeted advertising of your personal information. If you come to the Website from a different device or from a different browser on the same device, or if you clear your cookies, you will need to opt-out again, or use an opt-out preference signal, for that browser and/or device as well.

To learn more about the Global Privacy Control, please visit: https://globalprivacycontrol.org/#download

• Limit Use and Disclosure. We do not collect nor engage in uses of sensitive personal information that would trigger a right to limit use and disclosure of sensitive personal information under applicable state privacy law.
• Opt-Out of Profiling with Legal or Significant Effects. You may have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. However, we do not engage in such activities as described under applicable state privacy law, so there is no need to exercise this right.

CONSUMER REQUESTS AND VERIFICATION

Right to Non-Discrimination

We may not discriminate against you because you exercise any of your privacy rights contained in this Privacy Statement including, but not limited to:
• Denying goods or services to you;
• Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;
• Providing a different level or quality of goods or services to you; or
• Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

Verifying Requests

You may request to exercise your rights of access, deletion, or correction by contacting us as described in the Data Requests section below. To help protect your privacy and maintain security, we will take steps to verify your identity before processing your request. If you request access to or deletion of your personal information, we may require you to provide any of the following information: name, email address, telephone number, or postal address, and account information. When you make such a request, you can expect the following:

• As required under applicable law, we will verify your identity. You will need to provide us with your email address and full name. We may ask for additional information if needed.
• We will confirm that you want your information accessed, corrected, and/or deleted.
• We will confirm our receipt of your request within 10 days. If you have not received a response within a few days after that, please let us know by contacting us at the Website or phone number listed below.
• We will respond to your request within 45 days upon receipt of your request. If necessary, we may need an additional period of time, up to another 45 days, but we will reply either way within the first 45-day period and, if we need an extension, we will explain why.
• In certain cases, a request for access, correction, or deletion may be denied. For example, if we cannot verify your identity, the law requires that we maintain the information, or if we need the information for internal purposes such as providing services or completing an order. If we deny your request, we will explain why we denied it and delete any other information that is not protected and subject to denial.

Authorized Agents

You may designate an authorized agent to request any of the above rights on your behalf. You may make such a designation by providing the agent with written permission, signed by you, to act on your behalf. Your agent may contact us as described in the Data Request section below to make a request on your behalf. Even if you choose to use an agent, we may, as permitted by law, require:

• The authorized agent to provide proof that you provided signed permission to the authorized agent to submit the request;
• You to verify your identity directly with us; or
• You to directly confirm with us that you provided the authorized agent permission to submit the request.

Appeal Process

If you have made a request to access, correct, or delete your personal information under a state privacy law with an appeal right, and we have declined to take action, you may appeal our decision within 45 days of the denial. When you make such an appeal, you can expect the following:
• We will verify your identity. You will need to provide us with your email address and full name. We may ask for additional information if needed.
• We will review your appeal and respond in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision, within 45 days upon receipt of your appeal. If necessary, we may need an additional period of time, up to another 45 days, but we will reply either way within the first 45-day period and, if we need an extension, we will explain why.
• In certain cases, an appeal may be denied. For example, if we cannot verify your identity, the law requires that we maintain the information, or if we need the information for internal purposes such as providing Services or completing an order. If we deny your appeal, we will explain why we denied it and provide you with a method to contact your state’s Attorney General to submit a complaint.

Data Requests

To exercise your data rights described above, you can contact us via email to InvestorOperations@GriffinCapital.com.

11.     Contact Us

If you have any questions or concerns in connection with Griffin Capital’s information collection practice summarized in this Privacy Policy, please send an email, with the subject heading “Privacy Policy Question,” to InvestorOperations@GriffinCapital.com. In the email, please state your questions or concerns.

If you have any questions about the Services, please contact us at (424) 367-4250.