GDPR

PRIVACY NOTICE

English Version(¹) updated as at 2019.01.21 and issued in relation to KB Star Funds (the “Fund”)


We first invite you to familiarise yourselves with the few following key players as we will extensively refer to them in this Privacy Notice:


1. Personal data is any information relating to a data subject.

2. A data subject is a living natural person identified or identifiable in relation to her/his personal data.

3. An investor is any person (natural or not) investing, soliciting or solicited to invest, in the Fund.

4. A controller determines the purposes and means of personal data processing.

5. A processor processes personal data on behalf of, and upon instruction from, one or more controllers.

¹ This Privacy Notice is available in English version which are all accessible via
the internet on www.kbam.co.kr/ib/kbstarfunds or upon request to the contact point mentioned in Q&A 18, below.

1. Categories of data subjects

What/Who are the data subjects in relation to whom we process personal data?

The majority of data subjects in relation to whom the Fund and Carne Global Fund Managers (Luxembourg) S.A. acting in its capacity of
management company of the Fund process personal data fall into one or more of the three main categories of data subjects described in
the table below (“you”, “your” and more generally together the “data subjects”).




The above table uses terms such as “associated”, “involved”, “belong”, “supervising”, “assisting” and “contributing”.
As a natural person, you may be so associated, involved, belonging to, assisting and/or contributing in an unlimited number of private,
public and/or professional capacities, including – without limitation – as employee or self-employed, client, proxy-holder,
authorised signatory, representative, nominee, intermediary, bo ard or committee member, trustee, settlor, agent, officer, delegate,
consultant and/or adviser.

2. Categories of personal data

What are the categories of personal data that we process?

As a general rule we reserve the right to process any past, present or future personal data needed to attain the purposes described or referred to in
this Privacy Notice. However, in the table below we have listed the main categories of personal data we process together with a few illustrations.
Please note that these illustrations are not exhaustive and that certain illustrations may belong to one or more categories of personal data,
whether or not we have a contractual relationship with any of them or the entity they represent or work for.





The personal data that we process may consist of or result from any use of or activity on computer systems, network and website,
and may take any form possible. Personal data that we process may then include all types of electronic support, pictures, images, videos, sounds
and voice recordings (such as telephone or online conversation recordings).
Please note that the above categories of personal data are without prejudice to all specific or general personal data you have provided
or will provide us with from time to time.
The so-called “sensitive” personal data referred to in Q&A 3 below may also come in addition to or be part of the above categories of personal data.

3. Sensitive personal data

Do we process so-called “sensitive” personal data?

“Sensitive” personal data refer to personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs,
or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, and data concerning health
or a natural person's sex life or sexual orientation, as well as personal data relating to criminal convictions and offences or related security measures.
Sensitive personal data are sometimes referred to as “special category data” and “criminal offence data” targeted
by Articles 9 and 10 of the GDPR, respectively.
We do happen to process such sensitive personal data. However, we do so in only a limited number of instances.
We may notably process sensitive personal data (a) which you have manifestly made public; (b) necessary for reasons of substantial public interest; (c)
under the control of an official authority; and/or (d) when authorised by applicable law providing appropriate safeguards for your rights and freedoms.
As a matter of illustration, we may process personal data revealing political opinions (which you have not necessarily manifestly made public)
or relating to criminal convictions and offences when implementing our “know your customer” obligations.
We may also fortuitously process sensitive personal data when wilfully processing non-sensitive personal data.
As a matter of illustration, although we neither require nor need personal data revealing racial or ethnic origin or religious beliefs, nor genetic
or biometric data, this information is sometimes disclosed in the official identification documents (such as passport photo pages) we receive for
the purpose of implementing our “know your customer” obligations. If you do not want us to process this information and also
for the reasons described in Q&A 4 below, we therefore strongly suggest that you carefully black this type of data out in any document sent
or drawn to our attention.

4. Unsolicited personal data

What is our responsibility in relation to the processing of “unsolicited” personal data?

“Unsolicited” personal data basically refer to personal data which we have no intention, nor interest in processing,
mainly because these data are not needed to attain any of the purposes described or referred to in this Privacy Notice.
These are personal data which we did not solicit, and which we technically process (e.g. store and/or transfer),
sometimes quite fortuitously (as illustrated in Q&A 3 above), but for no specific purpose.
What is important for you to be aware of is that, in the absence of proven negligence on our part or unless otherwise so compelled
by mandatory rules of law, we assume no obligation nor any liability for any damage suffered directly or indirectly by you or any third party
as a result of such a technical processing, including in case of personal data breach.
In view of the foregoing, we strongly recommend that you exclusively provide personal data that are expressly required from you,
and that you refrain from providing any unsolicited personal data or making it available.

5. Source of personal data

From whom or where do we collect or obtain your personal data?

We collect or obtain your personal data from various sources (and a combination thereof), and we reserve the right to opt at any time for
any legally acceptable source. In practice, these sources may vary depending on the categories of natural persons described in Q&A 1 above.
Our first source of information is you. We collect your personal data each time we communicate with you.
We collect your personal data either directly from you or via third parties representing us or you.
Third parties representing us may typically be our register and transfer agent, our management company, certain of our distributors,
and other appointed intermediaries.
Third parties representing you may include discretionary managers, lawyers and specific proxyholders.
We may also obtain your personal data from a variety of third parties who represent neither us nor you.
These third parties may include certain of our service providers (such as the depositary), certain distributors, your banker, social medias,
subscription services and centralised investor database (whether or not they belong to the Fund initiator’s group), as well as your or our advisers.
Third parties from whom we may obtain your personal data may also be public authorities, bodies or services,
including Luxembourg and foreign supervisory and tax authorities.
We may also obtain your personal data via any publicly accessible (free or paying) sources such as
the internet, public registers (such as the Luxembourg Trade and Companies Register), and/or the press in general.
In relation to Investing Persons in particular, we may obtain your personal data via special “know your customer” databases (such as World-Check™).
We collect or obtain your personal data from various means (and combinations thereof), and we reserve the right to opt at any time
for any legally acceptable means. In the following paragraphs, we would like to draw your attention to a few of them.
The most obvious means of collection of your personal data is the subscription documentation,
including that required to fulfil our “know your customer” or tax transparency obligations (e.g. via self-certification forms).
But, we also collect information via your transactional activity or your visits to our website.
We may also obtain personal information via exchanges of correspondence (whether or not in digital form), via telephone conversations
(whether or not they are recorded), via contractual or operational documentation, via participation at board or shareholding meetings, and/or
in the course of a complaint or litigious procedure.

6. Types of processing

What types of processing do we perform on your personal data?

We perform and reserve the right to perform at any time any processing which the GDPR authorises us to perform on your personal data.
The processing that we perform or may perform therefore includes any operations (or set of operations) on your personal data
(or on sets of your personal data), whether by electronic or other means, such as collection, recording, organisation, structuring, storage, adaptation
or alteration, retrieval, consultation, use, disclosure by transmission, transfer, dissemination or otherwise making available, alignment
or combination, restriction, erasure or destruction.
In particular, we or our service providers acting as processors or controllers in their own right may be obliged
or wish to record communications (including telephone or online conversations and e-mails).
Recordings may be produced in court or other legal proceedings and permitted as evidence with the same value as written documents.
The absence of recordings may not in any way be used against us.
The purposes, lawful bases and retention periods in this respect are described in Appendix A and Appendix C respectively.
Please, also note that processing that we perform or may perform on your personal data may also consist in profiling
and solely automated individual decision-making.

7. Purposes and lawful bases of processing

For what purposes and on what lawful bases do we process your personal data?

We reserve the right to process your personal data for any specified, explicit and legitimate purposes we deem appropriate,
provided such processing is based on one or more of the 6 possible lawful (or legal) bases authorised by the GDPR.
These lawful bases are related to contract, compliance, vital interests, public interest, legitimate interests, and consent.
These lawful bases are more fully described in Appendix A of this Privacy Notice.
We process your personal data for several purposes and on several lawful bases.
In Appendix A, you will find tables listing the purposes of the processing (on the left-hand side column)
and the corresponding lawful bases (on the right-hand side column).
You should be aware that any of the (initial) purposes listed in Appendix A or otherwise referred to in this Privacy Notice may change over time
and lead to a new purpose.
If the new purpose is compatible with the initial purpose, we may continue the processing under the original lawful basis
(unless this original lawful basis is your consen
Finally, you should also be aware of the following regarding the lawful bases of our processing.
When we process sensitive personal data or transfer personal data to third countries, we may do so on specific lawful bases which are more fully
described in Q&A 3 and Q&A 9, respectively, and which come in addition to those otherwise described in this Q&A 7 and in Appendix A.
Also, when we exceptionally base the processing of your personal data on your consent, you are entitled to withdraw your consent
as more fully described in Q&A 14 below.

8. Recipients of personal data

Do we transmit your personal data to third-party recipients? If so, who are these recipients?

In the context of this Privacy Notice we understand “transmission” (or derived terms thereof) of personal data to a party
as including the disclosure, the accessibility or otherwise availability of these personal data to this party.


Yes, we also transmit your personal data to a series of recipients or categories of recipients these include:


You should also be aware that:

9. Transfer to third countries

Do you intend to transfer personal data to third countries or international organisations?

In the context of this Privacy Notice we understand “transfer” (or derived terms thereof) of personal data to third countries
or international organisations as including the disclosure, the accessibility or the otherwise availability
of these personal data to or from third countries or international organisations.


Yes, we do and will transfer personal data to third countries. And by third countries, we mean countries which do not belong to
the European Economic Area and which legislation does not necessarily ensure an adequate level of protection
as regards the processing of personal data.


In Appendix B of this Privacy Notice, you will find a brief description of the available lawful bases for performing transfers of
personal data to third countries, as well as a table listing the recipient countries or third-country recipients to which we transfer
or may transfer personal data (left-hand side column) together with the corresponding specific lawful bases and, where applicable,
additional information (right-hand side column). In this context, you should be aware that:


In addition to the information provided in Appendix B, you should be aware that:

10. Retention period

For how long will we store your personal data?

Without prejudice to what follows, as a matter of general principle, we take care that your personal data is not held for longer than necessary with
regard to the purposes for which they are or have been processed.
We hold personal data of Investing Persons at least until the concerned investor ceases to be an investor.
We then hold these personal data for a subsequent period of 10 years where necessary to comply with applicable laws and regulations,
and/or to establish, exercise or defend actual or potential legal claims.
Longer or shorter retention periods may apply where required by applicable laws and regulations, or as a result of applicable statutes of limitation.
Some of these law and regulations are listed in the table of Appendix C to this Privacy Notice.

11. Data subject Rights

What are your rights in relation to our processing of your personal data?

In addition to your right of information as well as to rights otherwise described in this Privacy Notice or provided for in the GDPR,
the available rights in relation to our processing of your personal data are as listed and briefly described below.
The relevant legal provisions of the GDPR describing these rights may in our opinion be read and understood by persons
who are not personal data protection professionals. For each of the rights listed below, we have therefore mentioned the applicable key provisions
which we invite you to consult for further information.


Under the limits set out by the GDPR:


You also have a right to obtain a copy of, or access to, any balancing test that has been conducted
when a processing is based on legitimate interests as per Appendix A of this Privacy Notice.
You may exercise any of the above rights (other than the right to complain to a supervisory authority) via any contact point and
by any means mentioned in Q&A 18 below.
There is a last general and important point we wish to draw your attention to. Your rights under the GDPR (including those listed above)
are not “absolute” or unconditional. Your rights may then be limited to certain cases or circumstances,
conditioned and/or affected by various elements such as the lawful basis of our processing.

12. Right to object

Do you have the right to object to our processing of your personal data?

Yes, Article 21 of the GDPR gives you a right to object, but this right is limited and depends on the purpose or lawful basis of our processing.

You may exercise your right to object via any contact point and by any means mentioned in Q&A 18 below.

13. Refusal to provide personal data

Can you refuse to provide your personal data? If so, what are the consequences?

There are certain cases where the provision of your personal data results from a legal or contractual obligation applicable to you and/or to us,
or where the provision of your personal data is necessary for us to enter into, continue and/or implement a professional relationship and/or contract,
and/or otherwise deal with you.
As a general rule, failure to provide certain requested personal data may result in the impossibility to communicate (or to communicate safely)
with you and/or to fulfil certain of our duties, obligations and services.
As an Investing Person in particular, failure to provide certain requested personal data may result in the impossibility for you or the investor to invest or
maintain an investment in the Fund. It may also result in incorrect or double reporting.
Please note that we may from time to time and as the case may be on a case-by-case basis indicate whether or not requesting and/or
providing this information is mandatory for us and/or for you, respectively, and/or the reasons for which this is mandatory.
Where necessary, we may also indicate on such occasions the consequences for your refusal to provide the requested information.

14. Withdrawal of consent

Can you withdraw the consent given for processing your personal data, and if so, how?

Yes, when we base the processing of your personal data on your consent, you have the right to withdraw your consent at any time,
yet without affecting the lawfulness of all processing based on your consent before its withdrawal.

Your decision to withdraw your consent may be notified to any contact point and by any means mentioned in Q&A 18 below.

15. Further processing

Do we intend to process your personal data for a purpose other than that for which they were collected or obtained?

Although we have no intention to do that at the date of issuance of this Privacy Notice, we reserve the right to further process your personal data for
a purpose other than that for which they were collected or obtained. If such were the case and prior to that further processing,
we would provide you with information on that other purpose and with any relevant further information required by
law which is not already contained in this Privacy Notice.

16. Other information

Is there other information we deem appropriate to provide you with in the context of this Privacy Notice?

Yes, we believe that the following additional information might be of interest to you.

17. Non-exhaustive information

Is this Privacy Notice exhaustive of all information pertaining to the processing of your personal data?

No. Although this Privacy Notice claims to be exhaustive in relation to the information that we must convey to data subjects pursuant to the GDPR,
it does not claim to be exhaustive of all information pertaining to the entire processing we perform as controllers.


In relation to personal data that we did not obtain directly from you, our duty to inform you does not apply insofar as:

18. Contact Point

What are our contact details and how can you contact us?



Email sent to kbgm@kbfg.com


Letter sent to 41F, Three IFC 10, Gukjegeumyung-ro, Yeongdeungpo-Gu, Seoul 07326, Korea and
for the attention of Barkely Lim / Jaesub Lee / Seunghwan Lim, Global Business Team, Global Investment Division, KB Asset Management


When you contact us, please, kindly provide your complete identification information, and state as clearly and completely as possible
why you are contacting us and what you expect from us. Please kindly note that before we are able to revert to you or implement your request,
you may be required to provide further identification details, information or clarification. You may also be required to fill out specific forms.
All this may be needed for adequately addressing your solicitation, as well as protecting both your and our interests.

List of Appendices and Schedules

APPENDIX A

Purposes and legal basis of the processing

The authorised lawful bases under the GDPR

Our processing of your personal data shall be lawful only if and to the extent that at least one of the following applies:

Our processing of your personal data for one or more specific purposes shall also be lawful if you have given your consent to this processing for
this or these specific purposes.








APPENDIX B

Transfers to third-countries

Appropriate safeguards

As indicated in Q&A 9, we only consider the following appropriate safeguards when your personal data are to be transferred to a recipient located in
a third country which is not subject to an adequacy decision. These appropriate safeguards may be provided for by:


Appropriate safeguards may also be provided for by a legally binding and enforceable instrument between public authorities or bodies, and
(subject to authorisation by competent supervisory authority) by provisions to be inserted into administrative arrangements between public authorities
or bodies which include enforceable and effective data subject rights.

Derogations

As indicated in Q&A 9, we only consider the following derogations when we have to make a transfer or a set of transfers of your personal data to
a recipient located in a third country which is not subject to an adequacy decision and where there is no appropriate safeguard. Such a transfer or
a set of transfers may take place only on one of the following derogatory conditions:



APPENDIX C

Specific retention periods

Without prejudice and subject to retention periods that are imposed by applicable laws, regulations and court orders, the following retention periods
should apply to personal data.


APPENDIX D

(Categories of) recipients of personal data