Privacy Policy

Version 1.0 — 2 August 2026. Effective 2 August 2026.

Universal Asset Owners is a media, research and events publication read by people who run some of the largest pools of capital in the world. Our readers are used to reading disclosure documents for a living. This one is written on the assumption that you will actually read it.

It sets out what personal information we collect, why we collect it, who we share it with, how long we keep it, and what you can require us to do about it. Where a law gives you a right, we say so and we tell you how to use it. Where we do something you might not expect — serving advertising, building a professional contact file for outreach, enriching a business email address — we say that too, plainly, rather than burying it.

The short version

You can read us without telling us who you are. No account is required to read the site.
We are advertising-supported. Third parties — including Google and our advertising partners — set cookies and use identifiers on this site to select and measure advertising. You can turn that off; see Your Privacy Choices.
We do not sell your personal information for money. We do disclose limited online identifiers to advertising partners in a way that some US state laws define as a "sale" or as "sharing" for cross-context behavioural advertising. You can opt out.
We honour Global Privacy Control. A GPC signal from your browser is treated as a valid opt-out of sale and sharing.
We build a professional contact file. If you work in institutional capital, we may hold your name, employer, role and work email even if you have never subscribed. Section 9 explains why and how to be removed.
One address for everything: info@universalassetowners.com. Write "Privacy" in the subject line and it reaches the Privacy Officer.

1. Who this policy covers

This policy applies to Universal Asset Owners ("UAO", "we", "us") — the publisher of universalassetowners.com and of the newsletters, research reports, podcasts, video briefings, databases, tools and events published under that name and under the Universal Asset Owners masthead. Universal Asset Owners is a Canadian publication and is administered from Canada.

It covers:

the website at www.universalassetowners.com and its subdomains;
our email products, including the daily brief and any premium, regional or topic newsletter;
our podcasts and video briefings, wherever distributed;
our research products, databases and interactive tools;
our events, roundtables, briefings and forums, whether in person or virtual; and
our commercial, sponsorship, partnership and press correspondence.

It does not cover a third party's own site or service that you reach from a link on ours, or a platform on which our content appears but which sets its own terms — Apple Podcasts, Spotify, YouTube, LinkedIn, X. Those services have their own policies and we do not control them.

For the purposes of the EU and UK General Data Protection Regulation, Universal Asset Owners is the controller of the personal data described in this policy, except where we say otherwise. For the purposes of Canadian federal and provincial privacy law, we are the organisation accountable for it. For the purposes of the California Consumer Privacy Act and its state analogues, we are the business.

2. What we collect

2.1 Information you give us

When	What we collect
You subscribe to a newsletter	Email address; first name and last name where you give them; the newsletters you selected; the date, time and source of the signup.
You create a member account or take out a paid subscription	Name, email address, institution, role, country, and your subscription status and history. Payment card details are collected and held by our payment processor, not by us — we receive only the outcome, the last four digits, the card brand and the billing country.
You register for an event, briefing or roundtable	Name, institution, role, work email, and any dietary, accessibility or travel information you volunteer. Where an event is held under the Chatham House Rule we say so; attendance lists are not published unless we tell you in advance that they will be.
You download a research report or request access	Name, work email, institution, role, and the report requested.
You use the contact form or write to us	Your name, email address, and whatever you choose to put in the message. Our contact form is delivered by a third-party form service; see section 8.
You take part in a survey or the Asset Owner Sentiment Survey	Your responses, and any identifying information you choose to attach. Survey results are published in aggregate. We do not attribute an individual response to a named person or a named institution without that person's express written permission.
You are interviewed, quoted or appear on a podcast	Your name, institution, role, contact details, the recording and the transcript. Where you speak on background or off the record we handle your identity under our Ethics & Conflicts policy, not this one — that policy is stricter.
You enquire about advertising, sponsorship or partnership	Your name, employer, role, contact details, and the substance of the discussion, held in our commercial records.
You apply for a role or pitch as a contributor	Your CV, work history, samples, references and correspondence.

2.2 Information collected automatically

When you visit the site or open one of our emails, we and our service providers collect technical information. This is ordinary for any publication of this kind, and it is how the site is operated, secured and paid for.

Device and connection: IP address, browser type and version, operating system, device type, screen dimensions, language and time zone.
Usage: pages viewed, time on page, scroll depth, referring URL, exit link, search terms used on our own site, the campaign parameters attached to the link you arrived on, and the date and time of each request.
Email interaction: whether an email was delivered, opened, and which links were clicked. Opens are measured with a tracking pixel; you can suppress this by turning off remote image loading in your mail client.
Advertising identifiers: cookies, local storage entries and similar identifiers set by us and by our advertising partners, used to select, cap, measure and report on advertising. Section 7 covers this in detail.
Audio and video: our podcast host and video host record plays, completion and approximate location derived from IP address.

We do not collect precise geolocation. We do not ask for it and no part of the site requests it from your device. Where we refer to your location, it is a country or region inferred from your IP address.

2.3 Information from other sources

Public and professional sources — institutional websites, regulatory filings, annual reports, conference programmes, press offices, published mastheads and professional networks — used to build and maintain our newsroom contact file and our coverage of institutions and the people who run them. See section 9.
Business data providers who supply or verify professional contact details for people working in institutional capital.
Email verification providers who confirm whether a work address is deliverable before we send to it, which reduces both bounce rates and the volume of mail sent to people who no longer hold a role.
Analytics and advertising partners, who return aggregate and pseudonymous measurement data about how our content and advertising performed.
Event and webinar partners, where an event is co-hosted and the partner registers attendees. We tell you at registration when this is the case and who the other party is.

2.4 What we do not collect

We do not knowingly collect special category or sensitive personal data — racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, sex life or sexual orientation — and we do not ask for it. If you volunteer such information to us in correspondence, we do not use it for any purpose other than replying to you. Dietary and accessibility requirements given for an event are used solely to run that event and are deleted after it.

We do not collect Social Insurance, Social Security or national identification numbers, government identity document numbers, or financial account numbers.

3. Why we use it, and on what legal basis

The table below sets out each purpose, and — for readers in the EEA, the United Kingdom and Switzerland — the legal basis under Article 6 of the GDPR on which we rely.

Purpose	Legal basis (EEA / UK)
Delivering the website, newsletters, podcasts, research and tools you asked for	Performance of a contract; consent for newsletter delivery
Operating, securing and debugging the site; preventing fraud and abuse	Legitimate interests — running a secure service
Measuring readership and understanding which coverage is read	Consent where analytics cookies are used; otherwise legitimate interests
Selecting, capping and measuring advertising, including personalised advertising	Consent
Administering membership, subscriptions and payment	Performance of a contract; legal obligation for tax and accounting records
Running events and briefings	Performance of a contract; legitimate interests
Journalism — reporting on institutions and the people who run them	Legitimate interests, read with the journalism exemptions in Article 85 GDPR, section 124 of the UK Data Protection Act 2018 and the journalistic-purposes exclusion in Canadian federal privacy law
Professional outreach to people working in institutional capital (section 9)	Legitimate interests, balanced against your interests, with an unconditional opt-out in every message
Commercial and sponsorship relationships	Performance of a contract; legitimate interests
Responding to correspondence, corrections and complaints	Legitimate interests; legal obligation where a rights request is made
Meeting legal, tax, regulatory and record-keeping obligations	Legal obligation

Where we rely on legitimate interests, we have carried out and recorded a balancing assessment, and you have the right to object — see section 11. Where we rely on consent, you may withdraw it at any time, and withdrawing it does not affect the lawfulness of what we did before you withdrew it.

4. We do not use your data to train models, and we do not sell your reading history

We do not license, sell or otherwise supply subscriber lists, reader identities, or reading histories to third parties for their own marketing. We do not make our subscriber file available for rent. Where a sponsor supports a report or an event, they receive the leads of people who expressly opted in to be introduced to that sponsor at the point of download or registration, and no one else — and we tell you, on that form, exactly who the sponsor is before you decide.

5. Advertising and how this publication is paid for

Universal Asset Owners is supported by advertising, sponsorship, research and events. Advertising is what keeps the daily brief free to read. It also means third parties are present on this site. Here is exactly what that means.

5.1 The standard disclosures

Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites.

Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the internet. You may opt out of personalised advertising by visiting Google Ads Settings. Alternatively, you can opt out of a third-party vendor's use of cookies for personalised advertising by visiting www.aboutads.info/choices.

Because we have not opted out of third-party ad serving, the cookies of other third-party vendors and ad networks may also be used to serve ads on this site. Those vendors may place and read cookies on your browser, or use web beacons, pixels or IP addresses to collect information, as a result of ad serving on this site.

This Site is affiliated with Monumetric (dba for The Blogger Network, LLC) for the purposes of placing advertising on the Site, and Monumetric will collect and use certain data for advertising purposes. To learn more about Monumetric's data usage, click here: Publisher Advertising Privacy.

5.2 What advertising partners receive

When an advertisement is requested for a page you are viewing, the following is typically transmitted to the advertising partner: your IP address, your user agent, the URL of the page, the referring URL, the dimensions and position of the ad slot, your approximate location derived from IP address, and any advertising cookie or identifier already present in your browser. Where you have consented to personalised advertising, an interest or audience segment may also be transmitted.

Your name and email address are never transmitted to an advertising partner. We do not upload our subscriber list to an advertising platform for matching, and we do not use hashed email addresses as an advertising identifier.

5.3 Sponsored content

Sponsored articles, sponsored research, sponsored webinars and sponsored event sessions are labelled as such, prominently and at the top, under our Editorial Standards. If you fill in a form inside sponsored content, we tell you on that form who receives the data. If it does not say a sponsor receives it, a sponsor does not receive it.

5.4 Consent, and where we are in implementing it

Readers in the European Economic Area, the United Kingdom and Switzerland must be asked for consent before non-essential advertising and analytics cookies are set, and the vendors relying on that consent must be disclosed to you before you give it. We are implementing a Google-certified consent management platform integrated with the IAB Europe Transparency and Consent Framework to do this. Until that platform is live, advertising served to readers in those territories is restricted to non-personalised advertising, and you can additionally use the controls in Your Privacy Choices. We would rather tell you where we are than imply a control exists that does not yet.

6. Cookies and similar technologies

We use cookies, local storage and comparable technologies for four things: keeping the site working, remembering that you are signed in, measuring readership, and selecting and measuring advertising. Only the first two are strictly necessary.

The full inventory — every cookie, who sets it, what it does and how long it lasts — is in our Cookies & Tracking Notice. Your controls are in Your Privacy Choices.

7. Who we share personal information with

We do not sell personal information for money. We disclose it to the categories of recipient below, each under a written agreement that limits them to processing it on our instructions, except where the recipient is an independent controller and we say so.

Recipient	What they do with it
Our publishing platform (Ghost)	Hosts the site, the member database and the newsletter delivery system. Processor.
Google Analytics	Aggregate readership measurement. We have IP anonymisation and data-sharing settings configured for the minimum. Processor.
Google AdSense / Google Ad Manager	Selects, delivers, caps and measures advertising. Independent controller for its own advertising purposes.
Monumetric (The Blogger Network, LLC)	Manages advertising placement and demand on the site. Independent controller for its own advertising purposes; see its Publisher Advertising Privacy notice.
Our advertising technology partners, including MailAdx and the demand partners they connect to	Fill web and newsletter advertising inventory. Independent controllers for their own advertising purposes.
Our podcast host and video host	Serve audio and video and report plays and completion. Processors.
Our customer relationship and outreach systems	Hold commercial, press and professional contact records and send the correspondence described in section 9. Processors.
Email verification and business data providers	Confirm that a work address is deliverable and current. Processors.
Our form provider and our payment processor	Deliver contact-form submissions; take payment. Payment card data goes to the processor and never reaches us.
Named event or research sponsors	Receive only the details of people who expressly opted in to be introduced to them, at the point of registration or download. Independent controllers thereafter.
Professional advisers, auditors and insurers	Where necessary for advice, audit or a claim.
Law enforcement, regulators and courts	Only where we are legally compelled, or where it is necessary to establish, exercise or defend legal claims. Where the law permits us to tell you about a request for your data, we will.
A successor	In a merger, acquisition or transfer of the publication, subject to the successor being bound by this policy until it gives you notice of a change.

8. Where your information goes

We are administered from Canada. Our platform, analytics, advertising and infrastructure providers are principally in the United States and the European Union, and their own sub-processors operate globally. Your personal information will therefore be transferred outside your country of residence, including to countries whose privacy laws differ from your own.

For transfers of personal data out of the EEA, the United Kingdom or Switzerland, we rely on the European Commission's adequacy decision for Canada (in respect of transfers to us), and on the Standard Contractual Clauses (with the UK International Data Transfer Addendum where relevant) or the EU–US Data Privacy Framework where a recipient is certified under it. We carry out a transfer risk assessment where the law requires one. You may request a copy of the safeguards applying to a specific transfer by writing to us.

For readers in Canada: your personal information may be processed outside Canada and may be accessible to the courts, law enforcement and national security authorities of those jurisdictions.

9. Professional contacts, press outreach and business correspondence

This section covers something a lot of publications do and few disclose. We would rather disclose it.

Universal Asset Owners maintains a professional contact file covering people who work at sovereign wealth funds, pension funds, endowments, foundations, insurers, family offices, asset managers, consultants, data providers, exchanges, law firms and the other institutions in our coverage universe. We compile it from public and professional sources — institutional websites, regulatory filings, published mastheads, conference programmes, press offices, professional networks — and from business data providers. It typically holds a name, employer, job title, work email address, work location and the public source we took it from.

We use it to do three things: reach people for journalism; invite people to events and briefings; and make commercial approaches about advertising, sponsorship and partnership.

What we hold ourselves to. We contact people at work, about work. We do not use personal or home addresses for this. Every message identifies us and gives a working, one-click way to stop hearing from us. We honour that request permanently, for the person and — on request — for the whole organisation. We do not add a professional contact to a newsletter list without their express consent; being in the contact file and being a subscriber are separate things, and one does not become the other.

If you are in the EEA or the UK, we rely on legitimate interests for this, and Article 14 GDPR requires us to tell you where we got your data. This section is that notice; if you write to us we will tell you the specific source for your record. You have an unconditional right to object to direct marketing, and if you exercise it we stop, permanently.

If you are in Canada, our commercial electronic messages are sent in reliance on the business-to-business and conspicuous-publication provisions of Canada's Anti-Spam Legislation, carry the sender identification and unsubscribe mechanism CASL requires, and honour unsubscribe requests within ten business days — in practice, immediately.

To be removed from the professional contact file entirely, write to info@universalassetowners.com with "Remove from contact file" in the subject. We keep a minimal suppression record — your email address, and the fact that you asked — because that record is the only way to guarantee we do not re-add you from a later source.

10. How long we keep it

Record	Retention
Newsletter subscription and engagement	While you are subscribed, then 24 months, then deleted. We also delete subscribers who have not opened an email in 24 months.
Member and paid subscriber account	While active, then 24 months after the last renewal
Payment and tax records	7 years, as Canadian tax law requires
Event registration and attendance	24 months after the event. Dietary and accessibility information: deleted within 30 days of the event.
Contact-form and general correspondence	24 months after the matter closes
Professional contact file	Reviewed every 12 months; removed when the person leaves the role or asks to be removed
Suppression and do-not-contact list	Indefinitely — this is the record that keeps the promise
Web analytics	14 months at event level, then aggregate only
Server and security logs	90 days
Advertising cookies and identifiers	As set out in the Cookies & Tracking Notice — typically 30 days to 24 months, depending on the cookie
Journalistic source material, notes, recordings and transcripts	Held for as long as necessary to defend the published work, and protected under our source-protection obligations
Job applications	12 months after the decision, unless you ask us to keep them on file
Published articles	Indefinitely. The published record is the point of a publication; see section 12.

11. Your rights

Everyone who writes to us gets the same treatment regardless of where they live. Where a specific law gives you a specific right, it is listed below.

11.1 Rights we extend to every reader

Know what we hold about you and why.
Get a copy of it, in a portable format.
Correct anything that is wrong.
Delete it, subject to the exceptions in section 12.
Opt out of marketing, of the professional contact file, and of personalised advertising.
Complain to us and, if we do not resolve it, to a regulator.
Not be discriminated against for exercising any of these. We will not degrade the site, withhold content, or change what you pay because you asserted a privacy right.

11.2 EEA, United Kingdom and Switzerland

You have the rights of access, rectification, erasure, restriction of processing, data portability, and objection — including an unconditional right to object to direct marketing. Where we process on the basis of consent you may withdraw it at any time. You have the right to lodge a complaint with your national supervisory authority; in the UK that is the Information Commissioner's Office, and in the EEA it is the authority in your country of residence, place of work, or where the alleged infringement occurred.

11.3 Canada

Under the Personal Information Protection and Electronic Documents Act and its provincial equivalents, you may access the personal information we hold about you, challenge its accuracy and completeness, and challenge our compliance with the Act. If you are in Quebec, Law 25 additionally gives you the right to data portability, the right to de-indexing of information about you in certain circumstances, and the right to be informed about and to submit observations on any decision made about you exclusively by automated means. We make no such decisions; see section 13. Complaints may be made to the Office of the Privacy Commissioner of Canada, or, in Quebec, to the Commission d'accès à l'information.

11.4 California and other US states

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Tennessee, Maryland, Indiana, Kentucky, Rhode Island or another state with a comprehensive privacy statute in force, you have the right to know, to access, to correct, to delete, to obtain a portable copy, to opt out of the sale or sharing of your personal information and of targeted advertising, and to be free from retaliation for exercising any of them.

Sale and sharing. We do not sell personal information for monetary consideration. Our use of advertising cookies and identifiers does constitute a "sale" and "sharing" for cross-context behavioural advertising as those terms are defined in the California Consumer Privacy Act, and "targeted advertising" under other state statutes. The categories involved are internet and network activity and inferences drawn from it, disclosed to advertising networks and their demand partners. You can opt out at Your Privacy Choices, and we honour Global Privacy Control as a valid opt-out signal, with confirmation displayed on that page once processed.

Sensitive personal information. We do not collect or process sensitive personal information for the purpose of inferring characteristics, and we do not use or disclose it beyond the purposes permitted without a right to limit. Personal information of anyone under 16 is treated as sensitive; see section 14.

You may use an authorised agent. We will ask the agent for proof of authorisation and may ask you to verify your own identity directly.

11.5 How to exercise a right

Write to info@universalassetowners.com with the right you are exercising in the subject line. We will acknowledge within 10 days and respond substantively within 30 days, or within 45 days where a US state statute allows and we tell you why we need the extra time.

We will ask you to verify your identity, proportionately to the sensitivity of what you are asking for — normally by replying from the email address the record is held under. We do not require you to create an account to make a request, and information you give us to verify a request is used only to verify it and is then deleted.

These services are free. We may charge a reasonable fee, or decline, only where a request is manifestly unfounded or excessive, and we will explain our reasoning if we do.

12. When we will not delete

We will refuse a deletion request, in whole or in part, where we are required or permitted to keep the information — to meet a legal or tax obligation, to establish or defend a legal claim, to maintain the suppression list that keeps you off our mailing, or to protect the security of the service.

We will also refuse where the information forms part of published journalism. Deleting a published article, a named quotation, or an accurate factual record of what an institution or a public figure did in a professional capacity is not a privacy right in any jurisdiction we operate in — it is unpublishing, and this publication does not unpublish. What we do instead is set out in our Corrections policy: if something we published about you is wrong, we correct it, visibly, and we say what we changed.

13. Automated decision-making

We do not make decisions about you that produce legal or similarly significant effects by automated means, and we do not profile you for that purpose. Content recommendations, newsletter segmentation and advertising selection involve automated processing, but none of them decides anything about your rights, your access to the publication, or what you pay.

14. Children

This is a publication for institutional investment professionals. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If we learn we have, we delete it. If you believe a child has given us personal information, write to info@universalassetowners.com and we will remove it.

15. Security

We hold personal information on infrastructure operated by established platform providers, encrypted in transit and at rest. Access is limited to the people who need it to do their work, protected by multi-factor authentication, and reviewed. We do not hold payment card data. We do not put personal information in prompts, logs, fixtures or generated documents.

No system is perfect, and anyone who tells you otherwise is selling something. If we suffer a breach of security that creates a real risk of significant harm to you, we will notify you and the relevant regulator as quickly as the law requires and, where we can, faster.

If you believe you have found a vulnerability in this site, write to info@universalassetowners.com with "Security" in the subject. We will not pursue a researcher who reports a genuine vulnerability to us in good faith and gives us a reasonable opportunity to fix it before disclosing it.

16. Changes to this policy

We will revise this policy as the site, the law and our commercial arrangements change. Every version carries a version number and a date at the top, and we keep the history below. Where a change is material — a new category of data, a new purpose, a new class of recipient — we will say so on the site and, where the law requires it, ask for your consent again before relying on the change.

Version	Date	Change
1.0	2 August 2026	First published.

17. Contact

The Privacy Officer, Universal Asset Owners — info@universalassetowners.com, subject line "Privacy". Universal Asset Owners is administered from Canada; a postal address for formal service is available on request.

If you are unhappy with how we have handled a privacy matter, tell us first — we would rather fix it. If we do not resolve it, you may complain to the Office of the Privacy Commissioner of Canada, to the Commission d'accès à l'information du Québec, to your national supervisory authority in the EEA, to the Information Commissioner's Office in the United Kingdom, or to your state Attorney General in the United States.