Privacy Policy

The controller responsible for the processing of personal data on this website is:

This Privacy Policy explains how personal data may be processed when visitors access this website.

The website is intended solely for corporate information. It currently does not provide user accounts, online purchases, newsletter subscriptions or public contact forms.

When the website is accessed, technical information may be processed automatically by the hosting provider in order to deliver the website securely and reliably.

This may include, where technically necessary:

• IP address
• date and time of access
• requested page or resource
• browser and device information
• operating system
• referrer information
• technical error and security logs

The purpose of this processing is the secure and technically stable operation of the website.

Where applicable, the legal basis is Article 6(1)(f) GDPR — legitimate interests, namely the legitimate interest in operating a secure and functional corporate website.

This website is hosted on the website infrastructure of Lovable, operated by Lovable Labs Incorporated, and delivered through the global content delivery network operated by Cloudflare.

The published website is served from network locations close to the visitor, independently of any database region. This website does not use a database or other backend storage service, so no database location applies to it.

Lovable makes a Data Processing Agreement publicly available:

lovable.dev/data-processing-agreement

That agreement applies to usage on Lovable’s Business and Enterprise plans. This website is published on the Pro plan, for which no signed Data Processing Agreement is in place. Lovable’s data processing nevertheless remains subject to Lovable’s Privacy Policy and to its technical and organizational security measures, which support data protection requirements such as those of the GDPR.

Where Cloudflare processes personal data on behalf of the website operator, Cloudflare’s Data Processing Addendum applies:

cloudflare.com/cloudflare-customer-dpa

The website’s own code does not set cookies, advertising cookies or marketing trackers.

The following technically necessary cookie is set by the delivery and security network, not by the website itself:

• __cf_bm — set by Cloudflare on this website’s own domain. It serves to distinguish automated requests from human visitors (bot and abuse protection). The cookie is HTTP-only, is valid for approximately 30 minutes, and is not readable by the website’s own pages.

The purpose of this cookie is the secure and technically stable operation of the website. Beyond this, the website’s own code does not store information in the visitor’s browser.

No consent banner is displayed. If non-essential cookies or similar tracking technologies are introduced, a consent mechanism will be added before they are used.

No visitor analytics service is used on this website. The visitor analytics provided by the hosting platform has been switched off for this website, so no analytics whatsoever is carried out.

No advertising or behavioural tracking tools have been implemented in this website’s own code.

This website contains links to external websites, including websites of family businesses and projects.

When visitors follow an external link, the privacy practices of the external website apply.

Royce Asset Management Limited is not responsible for the privacy practices of third-party websites.

Technical data should only be retained for as long as necessary for website operation, security and troubleshooting, subject to the retention periods applied by the hosting and delivery providers.

The delivery and security network states that request logs are made available for at least three days and up to seven days. The technically necessary __cf_bm cookie described under 05 is valid for approximately 30 minutes.

Personal data may be processed by technical service providers that support the hosting, security and operation of the website. Based on the checks performed, these are Lovable Labs Incorporated (hosting and website infrastructure) and Cloudflare (content delivery, security and bot protection).

Such providers act, where applicable, as processors on behalf of Royce Asset Management Limited.

The text fonts used by this website are held on the website’s own server and delivered from the website’s own domain. No connection to an external font service is established when the website is accessed. The images and other files displayed by the website are likewise delivered from the website itself.

The website is delivered from network locations worldwide. Access data may therefore be processed at points of presence inside and outside the European Economic Area.

Where the content delivery and security provider transfers personal data to a country without an adequacy decision, it does so on the basis of the European Commission’s Standard Contractual Clauses 2021/914/EU, which form part of its Data Processing Addendum for customers and are publicly available:

cloudflare.com/cloudflare-customer-scc

Under the GDPR, individuals may have the right to:

• access their personal data
• request correction of inaccurate data
• request deletion of personal data
• request restriction of processing
• object to processing based on legitimate interests
• receive applicable personal data in a portable format where legally relevant

Requests may be sent to:

office@royce-assets.com

Individuals have the right to lodge a complaint with a competent data protection supervisory authority.

For Royce Asset Management Limited, the relevant supervisory authority is:

Office of the Commissioner for Personal Data Protection, Republic of Cyprus

Royce Asset Management Limited may update this Privacy Policy where necessary to reflect changes in the website, technical services or applicable law.

Last updated: 9 October 2026