Privacy Policy of Sun Fintech Ltd

Introduction

The need to collect personal information from our clients and prospective clients is necessary in order to provide them with our products and services while satisfying their specific needs.

Your privacy is paramount to us and it is our mandate to protect and ensure that the confidentiality of the information we retain remains intact while respecting that privacy.

This Privacy Policy outlines how Sun Fintech Ltd (hereinafter referred to as “We”, “Us”, “Our” where the context so requires) collects, uses and manages the personal information we receive from our clients and users (hereinafter referred to as “You”, “Your”, “Yours” where the context so requires) in connection with our provision of services to you, or which we collect from your use of our services and/or our website, as well as any other related websites and applications.

The Privacy Policy also informs you of your rights with respect to the processing of your personal data.

Our Privacy Policy is revised regularly to ensure that any new requirements and technologies, changes to our business operations and practices are taken account of. The regular review of our Privacy Policy is also to ensure that our operations are up-to-date and at all times comply with the legal and regulatory requirements.

At any point in time, the personal data we gather and hold would be in accordance with the prevailing Privacy Policy.

This Privacy Policy applies to the processing activities performed by us to your personal data obtained by your use of our websites and platforms. This Privacy Policy does not apply to websites operated by any other organisations and/or other third parties.

The Data Controller

Sun Fintech Ltd is a private company limited by shares incorporated under the Laws of Mauritius since 30th January 2025 bearing Company No: 217346 GBC and holds a Global Business Licence and a Payment Intermediary Services Licence both issued by the Financial Services Commission of Mauritius (“FSC”) since 3rd February 2025 whose Licence Number is GB24203022. The Registration Address of Sun Fintech Ltd is 4th Floor, Ebene Skies, Rue De L'Institut, Ebene 80817, Mauritius.

Protection of Privacy and Confidentiality of Personal Information

Your privacy is very important to us and as such, we will ensure that we take all the necessary steps to protect your personal information and other data you share with us through your use of our websites and platforms.

We retain your personal data in accordance with the applicable data protection laws and regulations in force at the time of collection of, and throughout the period of retention of the said data.

We have put in place all the requisite technical measures to ensure that every information we collect from you remains safeguarded at all times. For instance, we have in our employ, a Data Supervisor, who is responsible for the management of the data we collect. Furthermore, we will frequently train all of our employees on the management of personal data of users and the need to protect such information and privacy.

Types of Personal Information Collected

As a user or a potential client, you are required to first complete and submit an application form to us in order to operate an account on any of the platforms covered by this privacy policy. This may require the disclosure of personal information to process the application effectively and in compliance with the relevant laws. The following information may be required of you for the application process:

• Name, Address and Contact Details
• Date of Birth, Place of Birth, Gender, Citizenship;
• Profession and Employment Details
• Source of Funds, Bank Account Information, Financial Statements, etc.
• Location Data
• Relevant Identification Numbers,
• Signature
• Any other information that may be required by us in the provision of our services to you

Collection of Data from Third Parties

Apart from the information that we get from you, we may also obtain some data about you from third parties, especially where the source of information is one that is already available to the public.

Furthermore, we keep records of your trading activities to enhance the type of services we provide to you. Some of the records we retain include:

• Products over which we trade with you
• Historical data about the type of trades and investments that you have engaged in.
• Your inclination towards specific products and services.

Recording of Communications Without Further Notice or Warning

Pursuant to our obligations via FSC, as well as our dedication to enhance the provision of services, notice is hereby served that we may cause to be recorded any form of communication that we may have with you concerning the services we offer to you. Please note that these recordings, which may be done without any further notice, would be our sole property and may be used as evidence of our communications.

Treatment of Personal Information Not Requested For

If for any reason we come to have in our possession your personal information, which is not required for the provision of our services or products, we shall immediately and securely destroy such information in accordance with the law.

Purpose for the Collection and Processing of Personal Information of User

The purposes for which we process your personal data have been enumerated below:

1. Provision of FX Brokerage Services

   The main premise upon which we process your personal data is to effectively provide you with our services and products, and any other purpose, which is incidental to the provision of those services and products. This would enable us, as well as the user to perform any obligations that may arise because of our contractual relationship, which may be formed, from the use of our websites and platforms.

2. User on-boarding processes

   We process your data as part of our on-boarding processes to ascertain your identity and to manage any account you may operate due to your use of our platforms and websites. This also enables us to assess the quality of service that we provide to you. The processing of your data therefore helps us satisfy Due Diligence and Know Your Customer (KYC) requirements under the law.

3. Compliance with law

   We are mandated by various laws, including laws of regulatory bodies, to process your personal data. Some of these laws include the Data Protection Laws, the Central Bank Regulatory laws, Anti-Money Laundering Laws, Credit Reporting Laws, Cyber Security Laws, Tax Laws, etc.

4. Protection of Legitimate Interests.

   We process your personal data to protect our legitimate interests. However, we shall ensure that in processing the data, we conform to the various principles regarding confidentiality and privacy.

   Some of the processing activities would include:

   • Internally sharing your personal data for the purposes of updating and verification of the said data
   • Processing your personal data to assist us in the commencement of legal actions and defending actions brought against us.
   • Processes undertaken to enhance our response to cyber threats and risks.
   • Processing data to manage our business and to improve our services and products that we provide to you.
5. To assess the suitability of our services and products for you and to help us improve them as well as develop and market new products.

   Processing of your personal data assists us in assessing whether the products and services we provide to you are appropriate for you. It also enables us to improve those products and services, as well as develop new suitable ones while maintaining the highest of standards.

6. To provide the user with information on our products and services

   After going through the on-boarding process and giving you access to operate an account with us, we would process your personal information in the performance of our obligations towards you and to provide you with all the necessary information regarding the products and services we provide to you.

7. For investigation purposes and settlement of disputes arising.

   It is in our legitimate interest to ensure that all issues, concerns and disputes are investigated and settled timeously. Thus, we may use the personal information we gather from you to enable us discharge this obligation.

8. To comply with applicable laws, court orders and regulatory requirements

   We may use your personal information in compliance with statutes or any applicable laws, court orders as well as regulatory requirements.

9. For User Surveys

   To enable us provide our services and products at the highest standards, we may ask you to participate in our surveys. Where you consent, we may process your personal data or information and depersonalise them for the purpose of the surveys, which is in our legitimate interest.

10. Data analysis

    We may use cookies, web beacons as well as other data analysis tools that allow us to track the kind of activities you engage in on our platforms and websites, as well as enable us analyse the number of users of our services. This helps us to maintain a structured statistical analysis of general usages on our platforms, which would help us to provide better products, and services, which is part of our legitimate interests.

11. Marketing purposes

    Pursuant to your consent, we may send you marketing communications by any agreed form such as email or telephone and in doing so, we may process your personal information. This is in our legitimate interest and would enable us keep you updated on our new products and services. In doing so, we shall not disclose your information to any third party.

12. Business, Research and Record-Keeping Purposes

    We may be required to process your personal information in pursuance of our internal business and research. We may also process your personal information to enable us keep records. This is required in order to advance our legitimate interest, as well as to comply with certain legal obligations.

13. Notification of changes to product, services, obligations or laws

    It is our obligation to inform you of changes made to our products, services, or even changes, which come about due of changes in the law. As such, the processing of your personal information is necessary to achieve this objective. We are enjoined by law to notify you of such changes, whether you consent to or not.

14. Corporate Restructuring, Mergers and Acquisitions

    Should there be a reason for us to undergo any form of restructuring, a merger, or an amalgamation, it may become requisite for your personal information to be shared as part of due diligence requirements or disclosures in pursuance of legal agreements.

Non-Disclosure of Confidential Information

We shall not disclose any of your confidential information to a third party, except in the following circumstances:

1. By reason of a provision of the law
2. Where there is a public duty to disclose such information
3. Where you request for the disclosure of such personal information or you give us your consent to disclose such information

Where there is a need or an obligation to disclose your personal information to a third party in accordance with the law, we shall notify any such person of the confidentiality of such information so requested.

As part of using your personal data for the purposes as stated above, we may where necessary, disclose your personal information to the following:

• Any member or authorised staff of Sun Fintech Ltd.
• Our Associates and Service providers for business-related purposes, including specialist advisers who have been contracted to provide us with administrative, financial, legal, tax, compliance, insurance, research or other services;
• Our business partners, credit providers, courts, tribunals and regulatory authorities such as the FSC, Mauritius Revenue Authority (“MRA”), the Registrar of Companies (“ROC”) and the Data Protection Office (“DPO”).
• Our contracted payment service providers (PSPs) and banking institutions in respect of concerns, which may arise because of deposits or withdrawals to and from trading account, held with us as well as for conducting an investigation into such trading account matters.
• Anyone authorised by you.

You must be aware that, if we disclose your personal information to our service providers such as card processing companies or banks, in order to perform our services to you, such third parties may retain your information in order to comply with their legal and other obligations. We emphasis however that we demand from such service providers and third parties who come into contact with your information as a result of dealings with us to acknowledge the confidentiality of such information. This is to ensure that we safeguard your privacy and the confidentiality of your information.

We wish to reiterate that the use of your personal information by external third parties who act as data controllers of your personal information is not covered by this Privacy Policy and is not subject to our privacy standards and procedures.

Transfer of Data Outside of the Jurisdiction

We may transfer your personal information inside or outside the jurisdiction to other affiliates and service providers such as processors. We will however ensure that the transfer is lawful and that these affiliates and service providers outside the jurisdiction are obligated to comply with the Data Protection Laws of Mauritius. Where there are no provisions regulating some of the activities related to the transfer of data outside the jurisdiction, we may in some cases rely on applicable standard contractual clauses, binding corporate rules, or any other equivalent applicable method of ensuring that your information is protected.

By submitting your personal data, you agree to this transfer, retention and processing of your information. We will take all steps necessary to ensure that your data is treated with utmost security and in accordance with this Privacy Policy and all applicable laws.

Information Obtained from Your Use of Our Websites and Platforms

Tracking systems used on our websites and platforms may gather some personal data in order to enhance the services that we provide to our client. Our websites collect information in one of different ways including but not limited to:

• Device information
  By identifying the device used to access our website(s), we can provide you with the most suitable version of our website, which can bring you efficiency.
• Log information
  By identifying certain activities logged on the site, we are able to track your activities and thus able to assess any technical issues that may occur.
• Location information
  We retrieve your IP address to enable us to localise the content we have on our websites, and thus assist in improving user experience.
• Cookies
  Cookies are small pieces of data usually stored on your machine by the web browser while browsing our website. The cookies are designed to retain your information through your browsing activities; these cookies help us to improve the performance of our website and our users' experience.

Grant and Revocation of Consent of User

We will obtain your consent in accordance with the express written terms available on our website, where that consent is necessary for our use of your personal information.

Please note that you have a statutory right to revoke such consent at any time by contacting us on the following e-mail address: contact@regulus.finance

Storage of Personal Information

The protection of your privacy is of extreme importance to us, regardless of the medium through which the user communicates with the controller. We shall retain your personal information in a secure electronic storage facility, as well as other records for as long as there exist between us a business relationship. We shall ensure that your personal information is protected from loss, misuse, unauthorised access or modification as well as disclosure.

Retention Period and Destruction of Data

Where the personal information is no longer necessary for the purpose for which it was collected, we are enjoined by law to remove any details that is capable of being linked to you or in the alternative take steps to securely destroy the records.

There may be circumstances that would require the Controller to maintain records for a long period. For example as per the ANTI-MONEY LAUNDERING AND COMBATTING THE FINANCING OF TERRORISM HANDBOOK 2020 which has been updated on 21 September 2022, Sun Fintech Ltd is required to keep books and records with respect to its customers and ensure that the records and underlying information are available on a timely basis to the regulatory authorities. These records are to be retained for a period of seven (7) years after our business relationship with you has ended.

Furthermore, the user's personal information held in the form of a recorded communication, by telephone, electronically, in person or otherwise will be retained for seven (7) years after the severance of the business relationship between the parties, pursuant to the relevant law. This period may be extended in cases where there is a legitimate interest at stake such as the settlement of a dispute between the parties. Again, the data may be retained longer than the number of years stipulated in this policy if by virtue of a legal regulatory or technical reasons; the said data cannot be deleted.

User's Rights Over the Use of Personal Information

Once we have collected your personal information in pursuance of a particular purpose, you would be entitled to the following rights:

• Information and Access

  You are entitled to enquire from us whether your personal information is being processed and the type or specific information being processed. In addition, you may request to be furnished with a copy of your personal information, as well as other details being processed by us and we would be obliged to so furnish you within thirty (30) days of the request.

• Rectification and Updating of Data

  If for any reason the personal information that we have collected about you appears to be incomplete or inaccurate, you are entitled to have it rectified. Where the said information has been shared or disclosed to third parties, we shall ensure that the third parties are informed about the rectification.

  Furthermore, you may notify us at any time where there has been a change in the personal information or details of that user. This may be done via the e-mail contact@regulus.finance

  In order for us to effect such changes, supporting documents may be required from you as proof of such changes.

• Removal of Data

  Where the purpose for which the data is collected ceases to exist, or you revoke your consent for the use of your personal data, you may request us to remove, erase or delete such data in a secure manner or in such a manner as is consistent with the law. We shall be obliged to delete such data as long as there is no legal obligation on us to retain the data. Any request for the removal or deletion of personal information is subject to the provisions contained in this privacy policy on storage as well as retention and destruction of data.

• Restrictions

  Where you object to the accuracy or processing of your data, you would be entitled to request us to restrict the processing of your data. This will however not prevent us from retaining such information. However, we shall inform you before declining the request to restrict the processing of the said data.

  Where there has been a disclosure of the data being sought to be restricted, we shall inform you of the third parties to whom such disclosures have been made and where permitted by law may inform the third party about the request to restrict processing of the data.

• Objection to the processing user's personal information

  You have a right to object to the processing of your personal information and we would be obliged to immediately stop the processing where processing the data is on the premise of our legitimate interests. However, where we can demonstrate that there are some legal grounds for the processing of the information or that processing personal information for direct marketing; or for research is essential in the interest of the public, that objection may not be upheld.

Disclaimer

• It may become necessary for us to disclose your personal information by virtue of some provisions of the law and in cases in which we believe that such disclosure is requisite for the protection of our rights, or to comply with court orders, regulatory bodies, or other statutory authorities.
• You shall not make a claim against us, and we shall not be liable for any unlawful or unauthorised use of your personal information due to misuse or misplacement of your passwords.
• We shall not be liable for any damage or loss caused to your personal information as a result of negligent or unnecessary intervention by you or due to your acts or omissions or a person authorised by you, whether that authorisation is in accordance with the terms of our legal relationship with you or not.

Review of the Privacy Policy

• Our Privacy Policy may be revised from time to time in order to incorporate amendments, new laws, changes in technology, revision of our operations, as well as to ensure that it is in conformity with the relevant changes in policies and legal environment.
• We shall notify you of any such reviews by posting the changes to this Privacy Policy on our websites and platforms. Such changes may also be brought to your attention by sending notifications via emails, our websites and any other place we deem appropriate.

Complaints

If you are not clear about any portion of this privacy policy, you can forward your queries to us via the email contact@regulus.finance and we will promptly address all your concerns.