Privacy Policy

Introduction

Alphatac (“we”, “us”, “our”) is committed to protecting your personal, financial, and family trust data. This Privacy Policy sets out our practices regarding the collection, use, disclosure, and protection of information when you access or use the Alphatac platform, our mobile applications, and our trust administration services. It forms part of, and should be read together with, our Terms and Conditions.

1. Information We Collect

To establish and administer trust deeds and to provide continuous portfolio monitoring, we collect the following categories of data:

• Personal Identification Data: Full legal name, national identity card (NRIC) or passport number, residential address, nationality, date of birth, contact number, and email address. • Beneficiary and Family Information: Legal names, relationship to the settlor, identification details, contact records, and designated allocation percentages for all named beneficiaries and trust guardians. • Financial and Trust Asset Data: Bank account numbers, source of funds declarations, asset valuations, insurance policy details, portfolio allocation figures, trust transaction histories, and distribution instructions. • Statutory Compliance and Due Diligence Records: Know-Your-Customer (KYC), Anti-Money Laundering (AML), and Counter-Financing of Terrorism (CFT) verification documentation, including biometric or photographic identification checks. • Technical and Usage Information: Device identifiers, IP address, operating system, browser specifications, login timestamps, audit logs of deed modifications, and platform navigation patterns.

Certain categories above, including biometric identifiers and health or financial information, may constitute sensitive personal data under applicable law. Where required, we collect and process such data only with your explicit consent or where processing is otherwise permitted by law.

2. Legal Basis And Purpose Of Processing

We process your personal and financial data on the basis of your consent, the performance of our contract with you, compliance with our legal and regulatory obligations, and our legitimate interests in operating the platform securely. Processing is carried out for the following purposes:

• Trust Establishment and Fiduciary Administration: Establishing and administering trust deeds, recording beneficiary entitlements, and enabling portfolio tracking. • Regulatory Compliance: Fulfilling mandatory obligations under statutory trust laws, financial services regulations, tax reporting requirements, and AML and KYC enforcement directives. • Identity Verification and Risk Management: Authenticating account access, verifying sign-offs on irrevocable instruments, and preventing fraud or unauthorised asset transfers. • Service Communication: Delivering portfolio balance notifications, trust milestone updates, statutory statements, security alerts, and administrative support. • Platform Security and Optimisation: Testing platform resilience, maintaining encrypted backup logs, and optimising application performance.

3. Disclosure And Sharing Of Data

We do not sell, rent, or trade your personal or financial data. We disclose information only under strict confidentiality and operational safeguards, and only to the following parties:

• Licensed Corporate Trustees and Custodians: Regulated trustee partners, custodial banks, and financial institutions directly responsible for holding, managing, and distributing trust assets in accordance with your deed. • Legal Counsel and Professional Auditors: Independent legal advisers, tax advisers, and accredited external auditors who review deed validity and verify operational compliance. • Infrastructure and Security Vendors: Cloud hosting providers, encryption specialists, identity verification services, and secure communication providers, each engaged under a formal Data Processing Agreement. • Legal and Regulatory Authorities: Government bodies, judicial authorities, statutory registries, and law enforcement agencies, where disclosure is required by court order, statutory notice, or applicable law.

4. Data Retention And Record Preservation

• Operational Account Data: Retained for the duration of your active account relationship with Alphatac. • Fiduciary and Legal Trust Records: Because an irrevocable trust creates binding legal entitlements for designated beneficiaries, core documentation — including executed trust deeds, beneficiary allocations, trustee authorisations, and asset transfer logs — is retained throughout the full tenure of the trust and for the statutory limitation periods applicable following its maturity and final settlement. • Compliance Logs: Retained in accordance with statutory AML, tax, and corporate record-keeping requirements, ordinarily seven (7) years following the cessation of the trust or the client relationship. Data that is no longer required for any of the purposes above is securely deleted or irreversibly anonymised.

5. Your Legal Rights

Subject to applicable data protection law and to our statutory fiduciary retention obligations, you have the following rights:

• Access: You may view, monitor, and retrieve your personal details, trust deed status, and portfolio performance at any time through your account dashboard. You may also request a copy of the personal data we hold about you, which we will provide within the period and on the terms prescribed by applicable law. • Rectification: You may request correction of inaccurate, incomplete, or outdated personal information. Formal amendments to executed irrevocable trust deeds remain subject to statutory procedures and trustee approval. • Erasure and Restriction: You may request deletion or restriction of processing of non-statutory data, where retention of that information is no longer required for legal compliance, fiduciary custody, or active trust execution. • Marketing Opt-Out: You may withdraw consent to receive promotional updates and general financial newsletters at any time through your in-app preferences. Requests may be submitted using the contact details in Section 12.

6. Information Security Measures

We implement multi-layered administrative, technical, and physical safeguards designed to protect wealth management data:

• SSL Encryption: Encrypts data transmitted between your device and our platform to prevent unauthorised interception. • Secure Servers: Stores your records in protected hosting environments designed to prevent unauthorised access. • Role-Based Access Control: Restricts internal access so that only authorised personnel may handle your account and trust files. While we maintain safeguards consistent with industry practice, no method of transmission or storage can be guaranteed to be entirely secure.

7. Tracking Technologies And Cookies

We use strictly necessary and performance-oriented cookies to facilitate secure login sessions, retain security authentication tokens, and optimise navigation. You may manage or disable functional cookies through your browser settings, although doing so may limit features required for secure financial verification.

8. Personal Data Of Minors And Vulnerable Beneficiaries

Trust arrangements may involve beneficiaries who are minors or who lack legal capacity. Where we hold personal data relating to such individuals, that data is provided by the settlor, trustee, or legal guardian, who is responsible for ensuring they are authorised to provide it. We process this data solely for the administration of the trust and apply the same safeguards set out in Section 6. Account registration and platform access remain restricted to persons aged 18 years and above.

9. Data Breach Notification

We maintain procedures to detect, assess, and respond to personal data breaches. Where a breach is likely to result in significant harm to affected individuals, we will notify the relevant supervisory authority and affected data subjects without undue delay and within the timeframes prescribed by applicable law.

10. Amendments To This Policy

We reserve the right to modify this Privacy Policy to reflect platform enhancements, operational changes, or statutory requirements. The current version and effective date are stated in the Document Control section of this document. Where significant revisions occur, we will notify you by in-app notice, email, or an updated timestamp on our portal. Your continued use of the platform following any modification constitutes acceptance of the updated Policy.

11. Governing Law, Complaints And Contact

This Privacy Policy shall be governed by and construed in accordance with the laws.

If you have questions regarding this Policy, wish to exercise your data rights, or wish to lodge a complaint about our handling of your personal data, please contact us at:

• Email: general.alphatac@capstargroups.com • Contact: 012-482-1063 If you are not satisfied with our response, you may be entitled to refer the matter to the data protection authority in your jurisdiction.