1. ABOUT US

NAGA Capital Ltd is a company incorporated in Seychelles with registration number 8427514-1 and located at CT House, Office 9A, 2nd Floor, Providence, Mahe, Seychelles (hereafter referred to as “NAGA”, and/or the “Company” and/or “we” and/or “us”). NAGA is part of the wider NAGA Group of Companies of The NAGA Group AG and all of its direct or indirect subsidiaries and/or direct or indirect parent undertakings, including but not limited to: NAGA Markets Europe Ltd, NAGA Technology Gmbh, and NAGA Pay Gmbh, as well as any subsidiary and/or any holding company from time to time of any of the aforementioned companies, and any subsidiary from time to time of a holding company of that company (hereafter referred to as the “NAGA Group”). NAGA is the ‘controller’ of your personal data – this means that NAGA determines the purposes and means of the processing of your personal data as expressly provided in this Privacy Policy (hereafter referred to as the“Policy”).

2. OUR COMMITTEMENT

Your privacy is of utmost importance to us, and it is our priority to safeguard and respect the confidentiality of your information, your privacy, and your rights. By entrusting us with your information, we would like to assure you of our commitment to keeping such information private and secure. We have taken all of the required technical and organisational steps to protect the confidentiality, security and integrity of your personal information and adhere to applicable statutory data protection requirements, including but not limited to the provisions of the Financial Consumer Protection Act, 2022 (“FCPA”), as illustrated herein.

3. PURPOSE OF THIS POLICY

This Policy sets out how and what personal data of users NAGA processes while using NAGA’s official website at www.nagacap.com (hereafter referred to as the “Website”), the NAGA App (hereafter referred to as the “App”) and social networks whereby we maintain online presences (hereafter referred to as the “Social Networks”), including any personal data you may provide through this Website, App and Social Networks when you obtain our services. For the purposes of this Policy:

• ‘personal data’ or ‘data’ means any information relating to an identified or identifiable natural person (‘data subject’, ‘you’, ‘your’ ); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

It also provides information on how and what personal data we may collect from third parties. Additionally, it provides information on how you can exercise your rights with respect to the processing of your personal data. This Policy applies to the processing activities performed by NAGA with respect to the personal data of its clients and potential clients, website and app visitors and users, since in order to provide our products and services to you, we need to collect your personal information, as specified in this Policy.

Our services are not aimed at individuals under the age of 18 years old. We do not knowingly collect information from children under the age of 18. If you have not reached the age limit in question, do not use the services and do not provide us with your personal information.

Additionally, if you have concerns about how we use your personal data, or requests on how to exercise your legal rights, please use the contact details below:

Entity: NAGA Capital Ltd
Contact Person: Data Protection Officer
Email address: dpo@nagacap.com
Postal address: CT House, Office 9A, 2nd Floor, Providence, Mahe, Seychelles
Telephone Number: +248 2574498

4. AMENDMENTS

The Company reserves the right to amend this document from time to time, and we will notify you appropriately and accordingly. We do, however, encourage you to review this statement periodically, in order to always be informed about how we are processing and protecting your personal data and contact our Data Protection Officer (DPO) at dpo@nagacap.com if you have any concerns.

5. WHAT PERSONAL DATA WE COLLECT AND HOW

The table below includes the type of personal data we process and how we collect it:

Type of personal data	Details
Information you provide to us	We collect information you provide when you: fill in any forms correspond with us respond to any of our surveys register to use the NAGA App open an account or use any of our services pursuant to the terms and conditions of the Client Agreement take part in online discussions or promotions speak with a member of our Social Networks or customer support teams (either on the phone or through the NAGA app) access, browse and/or use the NAGA feed share information with us on Social Networks contact us for other reasons We will collect the following information: your first name, last name, title, date of birth, address, nationality, citizenship, country of residence, national ID number or passport number; your phone number, email address, residential address, and proof of address (such as a utility bill or bank statement); investment education experience, risk appetite, capacity for loss, tax status; employment status, occupation (work industry), net annual income, main source of income, net worth, source of funds, anticipated account turnover and other financial information; details of the device you use (for example, your phone, computer or tablet); your NAGA username and ID (these are random and are automatically assigned to you when you join, but your username may change subject to your request to do so), your password, preferences, feedback and survey responses and marketing and communication data, such as your preferences in receiving marketing from us and our third parties and your communication preferences; your registration information; details of your bank account, including the account number, sort code (if applicable) and IBAN; details of your debit cards and credit cards (or other debit or credit cards you have registered with us) - only the four last digits of your card number, expiry date and name printed on the card; copies of your identification documents (for example, your ID, passport or driving licence) and any other information you provide to prove you are eligible to use our services; your country of residence, tax residency information, and tax identification number; records of our discussions, written or oral, if you contact us or we contact you (including records of phone calls) your image in photo or video form (where required as part of our Know-Your-Customer (KYC) checks, to verify your identity, or where you upload a photo to your NAGA account).
Information collected from your use of our products, services and website/app by using cookies (as per our Cookie Policy), and other similar technologies.	Whenever you use our website or the NAGA app and/or any other trading platforms in relation to NAGA’s services, we collect the following information: technical information, including the internet protocol (IP) address used to connect your computer to the internet, country (by IP), your login information, the browser type and version, the time zone setting, the operating system and platform, the type of device you use, a unique device identifier (for example, your device's IMEI number, the MAC address of the device's wireless network interface, or the mobile phone number used by the device), mobile network information, your mobile operating system and the type of mobile browser you use; information about your visit, including the links you’ve clicked on, through and from our website or app (including date and time), services you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling and clicks), and methods used to browse away from the page; information on transactions and your use of NAGA products (for example, your trading information), details of deposits, deposit methods, details of withdrawals, withdrawal methods, details of your trading activity through NAGA, including the date, time, amount, currencies, exchange rate, details of device used to arrange the payment and the payment method used.
Information collected from your use of our Social Networks and/or NAGA’s social feed.	We collect statistics on the use of our online presences, which are provided by the Social Networks in question. These statistics are aggregated and may include, in particular, demographic information and data on interaction with our online presences and the posts and content distributed through them. Your data is usually processed by the Social Networks concerned for market research and advertising purposes. In this way, usage profiles can be created based on the interests of the users. For this purpose, cookies and other identifiers are stored on your computers. On the basis of these usage profiles, advertisements, for example, are then placed within the Social Networks but also on third-party websites. For more details, you may refer to Section 8 below, since in many cases, we do not control the data collected from the use of Social Networks and you may opt-out via the Social Networks’ respective privacy policies and/or privacy options.
Information about your location	We track your location via your IP address.
Information from others	We collect personal data from third parties or other parties, such as financial or credit institutions, official and/or other registers and databases, fraud prevention agencies and partners who help us to provide our services, as well as other Affiliates. This includes information to help us check your identity, information about your spouse and family and/or associate (if applicable in the context of a potential Third Party Payment), information of your IP address information, when you are referred to us to register an account. Technical data from analytics providers, such as Google. In some cases, third parties, such as Affiliate partners you interact with, may share information about you with us, whereby they act as individual ‘controllers’. In such circumstances, we ensure that the relevant provisions of FCPA are respected and any information we receive about you has been provided with your prior consent. Even though we make sure that we enter into data sharing agreements in order to safeguard your data, we would also advise you to consult any relevant third party’s Privacy Policy, prior to registering for a NAGA account with us or providing any information to us, since we are not responsible for any information you disclose to such third parties before entering our Website or App.
Information from Social Networks	Occasionally, we’ll use publicly available information about you from selected Social Network websites, or apps, to carry out enhanced due diligence checks. Publicly available information from Social Network websites or apps may also be provided to us when we conduct general searches on you (for example, to comply with our anti-money laundering or sanctions related obligations).
Information from publicly available sources	We collect information and contact details from publicly available sources, such as media stories, online registers or directories, and websites for enhanced due diligence checks, security searches, and KYC purposes.

6. DISCLOSURE OF YOUR PERSONAL DATA

The Company may share your personal data for the purposes of processing transactions and providing services related to your account, as well as to secure our business interests and legal obligations regarding suspected abuse of anti-money laundering rules with any NAGA Group entity. Such sharing of data within the NAGA Group includes, and is not limited to, the data and documents collected by the Company for identification purposes.

The Company may also share your personal data with service providers in the areas of IT, Trading platforms administration, translation of documents, marketing, auditors, background screening providers, financial institutions, funds, payment recipients, payment and settlement infrastructure providers, exchanges, regulators, public authorities (including tax authorities), our other group entities and service providers, professional advisers, insurers and potential purchasers of elements of our business.

Where it is required to disclose your personal data to third parties for the purposes of performing our legal obligations towards you, we ensure that the relevant provisions of FCPA are respected. Specifically, we assess these third parties in respect of their compliance with the data protection laws and regulations, and ensure that all required contractual agreements are concluded. Respectively, we ensure that they are committed to ensuring the security of your information and to treating it in accordance with relevant laws and regulations. Finally, we do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions, where such third parties act as our ‘processors’.

The table below explains which suppliers we normally share your personal data with:

Type of supplier	Why we share your personal data
Suppliers who provide us with IT and payment services	To help us provide our services to you
Platform providers	To help us provide trading services to you
EMI, Bank Institutions, Payment Institutions	To safekeep your assets and/or execute your deposits/withdrawals
Administrative systems (KYC onboarding service providers, translation, due diligence, finance, reporting, risk analysis)	To help us perform checks in order to decide whether to provide our services to you and to maintain our daily operations
Internal Auditors	To help us comply with our legal obligations
Analytics providers and search information providers	To help us improve our website or app
Customer-service providers, survey providers and developers	To help us to provide our services to you
Communications services providers	To help us send you emails, push notifications and text messages
Data storage	To store your data

We may also share your personal data with government authorities, law enforcement authorities, tax authorities, companies and fraud prevention agencies to check your identity, protect against fraud, adhere to relevant tax laws, anti-money laundering laws, any other laws and to confirm that you are eligible to use our products and services. If fraud is detected, you could be refused certain services by NAGA or other NAGA Group entities.

We may also need to share your personal data with other third-party organisations or authorities, for legal reasons, such as:

• if we have to do so under any law or regulation
• if we sell our business
• in connection with criminal or fraud investigations
• to enforce our rights (and those of clients or others)
• in connection with legal claims
• under mandated Credit Reporting
• by court order

Where you direct us to share your personal data with a third party, we may do so. For example, you may authorise third parties to act on your behalf (such as a lawyer, accountant or family member or guardian, under a power of attorney, for example). We may need to ask for written proof that a third party has been validly authorised to act on your behalf.

7. HOW WE USE YOUR PERSONAL DATA

The Company may process your personal data in various ways, as explained below in more detail:

A. Providing our services
Whenever you sign up with NAGA, apply for or use a product or service, we will use your personal data to:

• verify your identity (as part of our KYC process);
• decide whether or not to approve your application;
• meet our contractual and legal obligations relating to any products or services you use (for example, trading from your NAGA account, withdrawing or depositing any amount in your NAGA account with your credit/debit card or otherwise);
• maintain your personal profile;
• monitor your trading activity in order to ensure and/or monitor execution quality;
• evaluate your knowledge and experience in the financial products that we offer, as well as your investment objectives, including your risk tolerance and financial situation, which are used to form your economic profile and confirm our assessment of the degree to which such financial products are appropriate to you; and/or
• inform you of changes to the terms or the features of our products or services, such as those associated with providing you with customer support services. We record and monitor all of our communications between you and us, including phone calls, in order to maintain appropriate records, check your instructions, analyse, assess and improve our services, and for training and quality control purposes.

B. Legal Obligations
Numerous laws to which we are subject to, as well as specific statutory requirements (such as antimoney laundering laws, financial services laws, corporation laws, privacy laws and taxation laws) dictate that we hold and process personal data. Such obligations and requirements impose on us necessary personal data storage and processing activities. It is mandatory, for example, to store personal data, for record-keeping purposes. In general, complying with applicable laws, court orders, other judicial process, or the requirements of any applicable regulatory authorities may require the processing of personal data by NAGA.

C. Protecting against fraud
We use your personal data to check your identity to protect against fraud, adhere to any financial crime related laws and to confirm that you are eligible to use our services. We also use it to help us better understand your financial circumstances and manage fraud risks related to your NAGA account.

D. Marketing and providing products and services that might interest you
We use your personal data to do the following:

• to personalise your in-app experience and marketing messages about our products and services so that they are more relevant and interesting to you (where allowed to by law). This may include analysing how you use our products, services and your transactions
• if you agree, to provide you with information about our partners’ promotions or offers which we think you might be interested in
• if you agree, to allow our partners and other organisations to provide you with information about their products or services
• measure or understand the effectiveness of our marketing and advertising, and provide relevant advertising to you
• ask your opinion about our products or services

E. To keep our services up and running
We use your personal data to manage our website and the NAGA app, (including troubleshooting, data analysis, testing, research, statistical and survey purposes), and to make sure that content is presented in the most effective way for you and your device.

We also use your personal data to:

• verify your identity if you contact our customer support or social media teams
• allow you to take part in interactive features of our services
• tell you about changes to our services
• help keep our website and the NAGA app safe and secure

F. Location-based monitoring
While using your NAGA account via our website or app, we use your personal data to:

• prevent illegal trading
• protect against fraud

G. Preparing anonymous statistical datasets
We prepare anonymous statistical datasets about our clients’ trading patterns:

• for forecasting purposes
• to understand how clients use NAGA products and services
• to comply with governmental requirements and requests

These datasets may be shared internally in the NAGA Group or externally with others, including non-NAGA Group companies. We produce these reports using information about you and other clients. The information used and shared in this way is never personal data and you will never be identifiable from it. Anonymous statistical data cannot be linked back to you as an individual.

For example, some countries have laws that require us to report spending statistics and how money enters or leaves each country. We will provide anonymised statistical information that explains the broad categories of merchants that NAGA’s clients in that country spend their money with. We will also provide information about how NAGA’s clients top up their accounts and transfer money. However, we will not provide any client-level information. It will not be possible to identify any individual NAGA client.

H. Improving our products and services
We may send you surveys as part of our customer feedback process. It is in our business interests to ask for such feedback to try to ensure that we provide our services and products at the highest standards. We may use the personal information provided by you through such client surveys to help us improve our products and services.

I. Meeting our legal obligations, enforcing our rights and other legal uses
We use your personal data:

• to share it with other organisations (for example, government authorities, law enforcement authorities, tax authorities, fraud prevention agencies, our regulator - the Financial Services Authority, or any other regulatory authority having control or jurisdiction over us or you or our associates or in whose territory we have clients or service providers, and as applicable);
• occasionally advise you of certain changes to products or services or laws (as we are required to do so by laws and regulations);
• to manage the risk and optimise the efficiency of our Group operations;
• if this is necessary to meet our legal or regulatory obligations;
• in connection with legal claims;
• to help detect or prevent crime.

8. ONLINE PRESENCE IN SOCIAL NETWORKS

We maintain online presences on Social Networks in order to communicate there with you and interested individuals, among others, and to provide information about our products and services. As part of the operation of our online presence, it is possible that we can access information such as statistics on the use of our online presence, which are provided by the Social Networks, as explained in the table above (in Section 5). You may refer to the list below for details to the data of the Social Networks that we can access as operators of the online presences.

For more details regarding the data processing carried out by the Social Networks on their own responsibility, please refer to the data protection information of the respective Social Network. You may have the option to object to the processing of your data, in which case you may refer to the privacy policy options of each Social Network.

Below is a list with information on the Social Networks on which we operate online presences. Please refer to the data protection information of the respective Social Network for the data processing carried out by that Social Network, at their own responsibility:

• Facebook
• Instagram
• Google / YouTube
• Twitter
• TikTok
• LinkedIn
• Google my business

• We operate a so-called Google My Business entry. Should you find us in this way, we make use of the information service offered by Google.
• We would like to point out that you use Google’s website and its functions at your own responsibility. This applies, in particular, to the use of the social and interactive functions (e.g. commenting, sharing, rating, direct messaging). When you visit and interact with our Google My Business listing, Google also collects your IP address and other information that is present on your terminal device, in the form of so-called cookies. This information is used to provide us, as the operator of the Google My Business listing, with statistical information about the use of Google services. The data collected about you in this context will be processed by Google and may be transferred to third countries. You may find more information about how Google processes personal data in Google’s privacy policy.
• We do not know how Google uses the data from the visit for its own purposes, to what extent activities of individual users are assigned, how long Google stores this data and whether this data is passed on to third parties. When accessing Google services, the IP address assigned to your terminal device is transmitted to Google. Google also stores information about its users’ end devices; this may enable Google to assign IP addresses to individual users or user accounts.
• If you contact us via our Google My Business entry or other Google services, by direct message, we cannot rule out the possibility that these messages may also be read and evaluated by Google (both by employees and automatically). We therefore advise against providing us with personal data there. Instead, another form of communication should be chosen, as early as possible. The use of this service is subject to the Google Privacy Policy, which you – with use – have already agreed to.
• We, as the provider of our Google My Business entry, do not collect or process any further data from your use of this Google service.

9. TECHNICAL AND OPERATIONAL SECURITY MEASURES

The Company has adopted practice controls and security measures to ensure a high level of information security and compliance with the relevant provisions of FCPA. Indeed, our administrative, physical, and technical safeguards that are implemented and maintained, protect your personal data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, sorted, or otherwise processed. Employees are authorized to access personal data only to the extent necessary to serve the applicable legitimate purposes for which the personal data is processed by the Company and to perform their duties.

The Company shall also conduct a Data Protection Impact Assessment (DPIA) in relation to any operation that may be likely to result in a high risk to the rights and freedoms of any data subject, in particular, in the use of new technologies. This DPIA shall be conducted prior to any processing taking place, regarding all activities, projects and systems involving the processing of personal data and taking into account the nature, scope, context and purposes of such processing.

Please be mindful not to share or disclose your log in details with any third party.

Details of these measures may be available upon request at dpo@nagacap.com, and subject to the discretion of the DPO.

10. COMMUNICATION

The Company will record, monitor and process any telephone conversations and/or electronic communications you have with us such as via phone, email, Social Networks or electronic message. All such communications are recorded and/or monitored and/or processed by us, including but not limited to any telephone conversations and/or electronic communications that result or may result in transactions or client order services, even if those conversations or communications do not result in the conclusion of such transactions. All incoming and outgoing telephone conversations, as well as other electronic communications between you and NAGA, will be recorded and stored for quality monitoring, training and regulatory purposes. The content of relevant in person conversations and/or communications with you may be recorded by minutes or notes. Any such records shall be provided to you upon request, in the same language as the one used to provide our services to you.

11. STORAGE AND RETENTION OF YOUR PERSONAL DATA

NAGA retains your personal information on secure servers and appropriate procedures and measures are in place to ensure that your personal data is safeguarded, as this is of utmost importance to us. We will hold your personal information while we have a business relationship with you, and as permitted by relevant laws and regulations. The retention of your personal data is limited for the purposes we collected it for, and in order for us to comply with any legal, regulatory, accounting, taxation or reporting requirement. The appropriate retention period for personal data is also determined in accordance with the provisions of FCPA.
Moreover, when we consider that personal information is no longer necessary for the purpose for which it was collected, we will remove any details that will identify you or we will securely destroy the records. However, we may need to maintain records for a significant period of time. For example, we are subject to certain anti-money laundering and taxation laws, which require us to retain the following data, for a period of seven (7) years after our business relationship with you has ended:

• a copy of the documents we used in order to comply with our customer due diligence obligations;
• supporting evidence and records of transactions with you and your relationship with us;
• communication records between us.

Also, the personal information we hold in the form of a recorded communication, by telephone, electronically, in person or otherwise, will be held in line with local regulatory requirements (i.e., 7 years after our business relationship with you has ended, or longer, in order to secure our business interests (such as handling a dispute with you).
We may keep your personal data for longer because of a potential or ongoing court claim, or for another legal reason.

12. WHAT ARE YOUR RIGHTS?

You have certain rights which you can exercise freely and at your own discretion, as per below:

• Request to review your personal information
• Request correction of the personal information that we hold about you: this enables you to have any incomplete or inaccurate information we hold about you corrected. Before we update your file, we may need to check the accuracy of the new personal data you have provided.

If you wish to exercise any of the above, you must send an email to the DPO of NAGA at dpo@nagacap.com and your request will be further handled.

Please be informed of the following:

a. Usually, no fee is required in order to exercise your rights, but we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive; or refuse to comply with your request in these circumstances;
b. we reserve the right to request specific information to confirm your identity, speed up our response and ensure your right to access your personal data or any other right as a data subject;
c. we will always respond to your request within a reasonable time and keep you updated

13. PERSONAL DATA BREACH

We have put in place appropriate procedures in order to deal with any breach of personal data and will notify you and any applicable regulator of a breach, where we are legally required to do so.