Privacy Policy for Stephens Group Asset Management, LLC

Effective Date and Last Updated

Effective Date: October 1, 2026
Last Updated: September 28, 2026

Who We Are

Stephens Group Asset Management, LLC
Our website address is: https://www.sgassetmgt.com.

What Does Stephens Group Asset Management, LLC Do With Your Financial Information?

Why? Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do.

What? The types of personal information we collect and share depends on the product or service you have with us. This information can include:

How? All financial companies need to share customers’ personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers’ personal information; the reasons Stephens Group Asset Management, LLC chooses to share; and whether you can limit this sharing.

Reasons We Can Share Your Personal Information

How Does Stephens Group Asset Management, LLC Protect My Personal Information?

To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files.

The firm maintains a written data security program that incorporates administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of personal information. To the extent applicable, these safeguards are intended to satisfy the Arkansas Personal Information Protection Act, Ark. Code Ann. §§ 4-110-101 et seq., including the requirements to implement and maintain reasonable security procedures and practices appropriate to the nature of the information and to take reasonable steps to render unreadable or undecipherable customer records containing personal information that are no longer to be retained. See Ark. Code Ann. § 4-110-104. The program includes, among other measures: (i) designation of personnel responsible for coordinating the security program; (ii) risk assessments of internal and external threats to the security of personal information; (iii) technical controls such as encryption, access controls, intrusion detection, and secure authentication protocols; and (iv) physical safeguards governing the storage, access, and disposal of records containing personal information. The firm periodically reviews and updates its data security program to address emerging risks and changes in technology, business operations, or applicable law.

If the firm is regulated by a state or federal law that provides greater protection and at least as thorough breach-disclosure requirements, compliance with that law constitutes compliance with the Arkansas Act for the subjects it covers, without relieving the firm of other applicable state or federal obligations. See Ark. Code Ann. § 4-110-106.

In addition, and independent of the safeguards described above, the firm maintains a written incident response program consistent with the U.S. Securities and Exchange Commission’s amendments to Regulation S-P (17 C.F.R. § 248.30), which are reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. Consistent with these requirements, the firm will notify each individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization as soon as practicable, and in any event within thirty (30) days of becoming aware that such unauthorized access or use occurred, unless a longer period is permitted because notification would pose a substantial risk to national security or public safety and the U.S. Attorney General has notified the firm in writing of such risk. The firm also requires its service providers, by contract, to notify the firm within seventy-two (72) hours after becoming aware that a breach in security has occurred that resulted in unauthorized access to or use of customer information.

How Does Stephens Group Asset Management, LLC Collect My Personal Information?

We collect your personal information, for example, when you:

We also collect your personal information from other companies.

We may also collect personal information through our website, such as through contact forms, account access portals, or other online tools made available at https://www.sgassetmgt.com.

Information We Collect Through Our Website

When you visit our website at https://www.sgassetmgt.com, we may automatically collect certain technical information about your visit. This information is collected through server logs, cookies, and similar technologies, and may include the following:

We use this information to operate and maintain our website, monitor site performance, analyze usage trends, and improve the functionality and security of our online services. This technical information, standing alone, generally does not identify you personally. However, if such information is combined with other Personal Information we hold about you, we will treat the combined data in accordance with this Privacy Policy. Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.100 et seq.), the categories of technical data described above (including your IP address, device identifiers, and browsing activity) constitute “Personal Information,” and, particularly when combined, may trigger notice-at-collection obligations; these categories are collected for the business purposes identified above and are subject to the California privacy rights described in the “California Privacy Rights (CCPA/CPRA)” section below.

We do not use automated decision-making or profiling based on information collected through our website.

Definitions

Affiliates: Companies related by common ownership and control. They can be financial and nonfinancial companies.

Nonaffiliates: Companies not related by common ownership and control. They can be financial or nonfinancial companies. We do not share with nonaffiliates so that they can market to you.

Joint Marketing: A formal agreement between nonaffiliated financial companies that together market financial products or services to you. We do not jointly market.

Personal Information: Information that identifies, relates to, describes, or is reasonably capable of being associated with a particular individual, including the nonpublic personal information described above.

Sensitive Personal Information: Personal Information that reveals a Social Security, driver’s license, state identification card, or passport number; financial account, debit card, or credit card number in combination with any required security or access code or password; precise geolocation; or other categories of sensitive personal information as defined under applicable state privacy law.

Sale and Share: “Sale” means disclosing Personal Information to a third party for monetary or other valuable consideration. “Share” means disclosing Personal Information to a third party for cross-context behavioral advertising. As described below, we do not sell or share Personal Information.

Cookies and Tracking Technologies

When you visit our website at https://www.sgassetmg.com, we may use cookies and similar tracking technologies to collect certain information automatically. The categories of cookies we use include the following:

You may manage or disable cookies through your browser settings at any time. Please note that disabling certain cookies may limit the functionality of our website or your ability to access certain features. Consult your browser’s help documentation for instructions on adjusting cookie preferences.

We do not sell Personal Information, and we do not share Personal Information for cross-context behavioral advertising. Where required by applicable law, we honor the Global Privacy Control and other similar opt-out preference signals as a valid request to opt out of the sale or sharing of Personal Information, and we will provide a clear confirmation when such a signal has been received and processed. Because no common, industry-accepted standard for responding to browser “Do Not Track” (DNT) signals has been adopted, our website does not currently respond differently to DNT signals; however, as described above, we do honor the Global Privacy Control and other recognized opt-out preference signals where required by applicable law.

Embedded Content From Other Websites

Our website may contain links to third-party websites or display content provided by third parties. Stephens Group Asset Management, LLC is not responsible for the privacy practices or content of any third-party websites. We encourage you to review the privacy policies of any external sites you visit.

Who We Share Your Data With

This section describes how we share your Personal Information and should be read together with the disclosures in the “Reasons We Can Share Your Personal Information” table above. In addition to the sharing described above, we may disclose your personal information to the following categories of third-party service providers and entities as necessary to operate our business and service your accounts: (a) custodians and broker-dealers; (b) technology, software, and cloud service providers; (c) regulatory authorities, including the SEC and state regulators; (d) auditors and accountants; (e) legal counsel; and (f) other service providers who assist us in administering your accounts, subject to contractual obligations to protect your information.

How Long We Retain Your Data

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, to comply with applicable SEC and state regulatory record-retention requirements, and in accordance with our internal record-retention policies. When personal information is no longer required, we dispose of it in a secure manner.

What Rights You Have Over Your Data

Under federal financial privacy law, you have the right to limit certain sharing of your personal information as described in this Privacy Policy. Under the Arkansas Personal Information Protection Act, a person or business that acquires, owns, or licenses computerized data containing personal information generally must notify an Arkansas resident if the resident’s unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Notice must be provided in the most expedient time and manner possible and without unreasonable delay, consistent with legitimate law-enforcement needs and measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. Notice is not required if, after a reasonable investigation, the person or business determines that there is no reasonable likelihood of harm to customers. See Ark. Code Ann. § 4-110-105. If you believe your information has been subject to a security breach, please contact us using the information provided below. You also have the right to be notified in the event of unauthorized access to or use of your sensitive customer information when notice is required under SEC Regulation S-P, as described above.

California Privacy Rights (CCPA/CPRA)

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.100 et seq.), California residents have the right to: (i) know and access the categories and specific pieces of Personal Information we have collected about them; (ii) request deletion of their Personal Information, subject to applicable exemptions; (iii) correct inaccurate Personal Information; (iv) opt out of the sale or sharing of Personal Information; (v) limit the use and disclosure of Sensitive Personal Information; and (vi) not receive discriminatory treatment for exercising any of these rights. California residents may designate an authorized agent to submit requests on their behalf and have the right to appeal a denied request. We do not sell or share Personal Information as those terms are defined under the CCPA. As described above, we recognize and will honor Global Privacy Control signals as a valid consumer request to opt out of sale and sharing.

Categories of Personal Information Collected; Sources, Purposes, and Recipients

In the preceding twelve (12) months, we have collected the following categories of Personal Information about California residents through our website and in connection with our services: identifiers (such as name, email address, Internet Protocol (IP) address, and device identifiers); internet or other electronic network activity information (such as browser type, operating system, referring and exit URLs, pages visited, and cookie data); commercial information; professional or employment-related information; financial information; geolocation data; and inferences drawn from the foregoing. We collect this information from the following sources: directly from you; automatically through your interaction with our website (via server logs, cookies, and similar technologies); and from other companies and service providers. We collect and use this information for the business and commercial purposes described in this Privacy Policy, including to operate, maintain, and secure our website, to provide and service our financial and investment advisory products, to communicate with you, to comply with legal and regulatory obligations, and for the everyday business and marketing purposes described in the “Reasons We Can Share Your Personal Information” table above. In the preceding twelve (12) months, we have disclosed Personal Information for business purposes to the following categories of third parties: custodians and broker-dealers; technology, software, and cloud service providers; regulatory authorities; auditors and accountants; legal counsel; and other service providers who assist us in administering your accounts. We have not sold or shared Personal Information in the preceding twelve (12) months.

Notice of Right to Opt Out of Sale and Sharing

You have the right to opt out of the sale or sharing of your Personal Information. Because we do not sell Personal Information and do not share Personal Information for cross-context behavioral advertising, we do not provide a “Do Not Sell or Share My Personal Information” link. Consistent with the disclosures above under “Cookies and Tracking Technologies,” we recognize and honor the Global Privacy Control and other similar opt-out preference signals as a valid request to opt out of the sale or sharing of Personal Information, and we will provide confirmation when such a signal has been received and processed.

California “Shine the Light” Rights

Under California’s “Shine the Light” law (Cal. Civ. Code § 1798.83), California residents may request certain information regarding our disclosure of Personal Information to third parties for those third parties’ own direct marketing purposes. We do not disclose Personal Information to third parties for their direct marketing purposes, and therefore no such disclosures are made.

Scope of the GLBA Exemption

Personal Information that we collect, use, and disclose in accordance with the Gramm-Leach-Bliley Act and its implementing regulations is exempt from the CCPA (Cal. Civ. Code § 1798.145(e)). This exemption is limited to Personal Information collected in connection with the financial products and services described in the “Reasons We Can Share Your Personal Information” table above. Personal Information we collect through our website, marketing activities, or other channels outside the scope of GLBA remains subject to the CCPA and the rights described in this section. For the avoidance of doubt, the technical information we collect through our website — including IP addresses, cookie identifiers, and device identifiers described above — is not collected in connection with a GLBA financial product or service, falls outside the § 1798.145(e) GLBA exemption, and is fully subject to the CCPA.

Rights for Residents of Other U.S. States

A number of other states — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island — have enacted comprehensive consumer privacy laws, many of which include a similar GLBA-related exemption. As a matter of firm policy, and to apply our most stringent applicable standard, we extend the rights described in this section (access, deletion, correction, opt-out of sale/sharing, and non-discrimination) to all U.S. residents and clients who contact us to exercise them, regardless of state of residence.

Children’s Privacy

Our services are directed to adults seeking financial and investment advisory services and are not directed to, marketed to, or knowingly used to collect Personal Information from individuals under the age of 16. If we learn that we have collected Personal Information from an individual under 16 without appropriate consent, we will take reasonable steps to delete such information.

How to Exercise Your Rights

You may submit a request to exercise any of the rights described in this section using the contact information provided below. We will verify your identity before responding to your request using information already in our records or by requesting additional identifying information. We will confirm receipt of your request within ten (10) business days and will respond to your verifiable request within forty-five (45) days of receipt, extendable by an additional forty-five (45) days where reasonably necessary and with notice to you. We will not discriminate against you for exercising any privacy right. If we deny your request in whole or in part, you may appeal our decision by contacting us using the information below, and we will respond to your appeal within forty-five (45) days of receipt, or within the time otherwise required by applicable law.

Regulatory Complaints

If you believe your privacy rights have been violated, you may file a complaint with the U.S. Securities and Exchange Commission or the Arkansas Attorney General, or, for California residents, the California Privacy Protection Agency (CPPA), in addition to contacting us directly.

Where Your Data Is Sent

Your personal information is stored and processed in the United States. By using our services or accessing our website, you acknowledge that your information will be handled in the United States in accordance with this Privacy Policy and applicable federal and state law.

Contact Us

If you have questions about this Privacy Policy or our privacy practices, you may contact us at:

California residents may also submit a privacy request through our online request form available at https://www.sgassetmgt.com/privacy-request.

You may also visit our website at https://www.sgassetmgt.com for additional information about our services and practices.