Privacy Policy

Version 1.0 — June 2026

1. Introduction

1.1. This Privacy Policy (the "Policy") explains how ST Global Markets (Mauritius) Limited (the "Company", "we", "us" or "our") collects, uses, discloses, transfers and protects your personal data, and the rights you have in relation to it.

1.2. The Company is the data controller in respect of the personal data it processes about you. The Company processes personal data in accordance with the Data Protection Act 2017 (the "DPA") and applicable Mauritius law.

1.3. This Policy forms part of, and should be read together with, the Company's Terms of Business. Capitalised terms used but not defined in this Policy have the meaning given to them in the Terms of Business.

1.4. By accepting this Policy and the Terms of Business, you acknowledge that you have read and understood how the Company processes your personal data as described here.

2. Personal Data We Collect

2.1. We collect and process the following categories of personal data:

• Identity data — name, date of birth, nationality, gender, and government-issued identification (such as passport or national identity card);

• Contact data — residential address, email address and telephone number;

• Financial and transactional data — bank account and cryptocurrency wallet details, deposits and withdrawals, trading activity, balances and account history;

• Verification and compliance data — proof of address, source of funds and source of wealth information, tax residence and self-certification, politically-exposed-person status, and sanctions and adverse-media screening results;

• Technical and usage data — IP address, device and browser information, login data and platform usage;

• Communications data — correspondence with us, and recordings of telephone calls and electronic communications.

2.2. We do not generally seek to collect special categories of personal data (as defined in the DPA). Where any such data is unavoidably processed in the course of identity verification, it is processed only to the extent permitted by the DPA.

3. How We Collect Personal Data

3.1. We collect personal data:

• Directly from you, when you complete the Application Form, use the Trading Platform, deposit or withdraw funds, or communicate with us;

• Automatically, through your use of our website, client portal and Trading Platform; and

• From third parties, including introducing brokers and affiliates, payment service providers, banks, identity-verification, credit-reference, fraud-prevention and sanctions-screening providers, and publicly available sources.

4. Purposes and Lawful Bases for Processing

4.1. We process your personal data on the following lawful bases under the DPA, for the purposes indicated:

• Performance of a contract — to open and administer your Trading Account, execute and settle your Transactions, process deposits and withdrawals, and provide customer support;

• Compliance with a legal obligation — to carry out customer due diligence, ongoing monitoring and reporting under the Financial Intelligence and Anti-Money Laundering Act 2002 and the FSC's AML/CFT framework; to comply with tax-reporting obligations (including FATCA and the Common Reporting Standard); and to comply with the requirements of the FSC and other competent authorities;

• Legitimate interests — to prevent fraud and financial crime, ensure the security and integrity of our systems, manage risk, and operate and improve our business, provided these interests are not overridden by your interests and rights; and

• Consent — for direct marketing (where required) and for certain cookies and similar technologies. Where we rely on consent, you may withdraw it at any time.

5. Marketing

5.1. Where required by law, we will send you marketing communications only with your consent. You may opt out of marketing at any time, without affecting the provision of the Services, by using the unsubscribe mechanism in our communications or by contacting us using the details in section 13.

6. Disclosure of Personal Data

6.1. We may disclose your personal data to:

• Our liquidity provider(s), banks and payment service providers, to the extent necessary to execute Transactions and process payments;

• Introducing brokers and affiliates connected with your account;

• Service providers and processors who act on our behalf under written agreements, including our customer-relationship-management and back-office providers, identity-verification, screening and IT providers;

• Regulators and authorities, including the FSC, the Financial Intelligence Unit, the Mauritius Revenue Authority and any other competent authority, where required or permitted by law;

• Our professional advisers (such as auditors and lawyers) under a duty of confidentiality; and

• A successor or assignee of our business, in connection with a reorganisation, transfer or sale.

6.2. Where we engage a processor, we require, by written agreement, that the processor acts only on our instructions and applies appropriate security and organisational measures.