پرائیویسی پالیسی

1. Introduction

Keytech Limited ('the Company') is a company incorporated in the Republic of Seychelles under the Companies Act, 1972, bearing company registration number 8430672-1. The Company's registered office and principal place of business is CT House, Office 9A, Providence, Mahé, Seychelles. The Company is part of a wider group headed by Temba Investments – FZCO, which also holds a Mauritian Investment Dealer licence and a South African FSP licence.

The Company is licensed by the Financial Services Authority of Seychelles ('FSA') as a Securities Dealer under the Securities Act, 2007 (as amended, including by the Securities (Amendment) Act, 2024). The Company operates under the trade name 'Keytech' (together with any additional trade name the Company may register) through its website and trading platforms, dealing as both principal and agent—including as an online brokerage and market maker—and offers Contracts for Difference ('CFDs') on Forex, commodities, indices, shares, energies, futures, options and cryptocurrencies/digital assets, principally to retail, professional, corporate and high-net-worth clients located in Africa and South East Asia.

The Company's governance, operations and conduct of business are subject to the laws of the Republic of Seychelles, including, without limitation, the Securities Act, 2007 (as amended), the Securities (Conduct of Business) Regulations, 2008, as amended by the Securities (Conduct of Business) (Amendment) Regulations, 2024, the Securities (Advertisement) Regulations, 2008, the Securities (Forms and Fees) Regulations, 2008, the Financial Services Authority Act, 2013, the Anti-Money Laundering and Countering the Financing of Terrorism Act, 2020 and its subsidiary legislation, the Beneficial Ownership Act, 2020, the Prevention of Terrorism Act, 2004, the Data Protection Act, 2023, and the Companies Act, 1972.

The Company's governance and control functions have been established in accordance with the requirements of the Securities Act, 2007 (as amended), the Securities (Conduct of Business) (Amendment) Regulations, 2024, and the Anti-Money Laundering and Countering the Financing of Terrorism Act, 2020. The Company has appointed an outsourced Compliance Officer and has temporarily appointed the Compliance Officer to perform the function of Complaints Handling Officer until the commencement of operations, following which a permanent Complaints Handling Officer will be appointed. Certain appointments, including those requiring regulatory approval, remain subject to the applicable fit-and-proper assessments and approval by the Financial Services Authority ('FSA'). No individual shall perform a regulated or controlled function requiring regulatory approval until such approval has been obtained.

This Privacy Policy (the 'Policy') sets out how the Company collects, uses, discloses, transfers, retains and safeguards personal data belonging to its clients, prospective clients, beneficial owners, authorised representatives, website visitors and other individuals (together, 'Data Subjects' or 'you') in connection with its business as a Securities Dealer. The Policy is issued in accordance with the Data Protection Act, 2023 of the Republic of Seychelles, and has also been prepared having regard to internationally recognised data protection principles and, where applicable, the General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR.

For the purposes of this Policy and applicable data protection law, the data controller is Keytech Limited (Registration No. 8430672-1), of CT House, Office 9A, Providence, Mahé, Seychelles. Queries about this Policy, or requests to exercise any of the rights it describes, should be directed to support@elev8.com.

2. Scope of this Policy

This Policy applies to all personal data processed by the Company in connection with its regulated business as a licensed Securities Dealer. Personal data may be collected and processed through the Company's website and trading platforms upon their launch, as well as through its client portal, mobile application, email and telephone communications, paper correspondence, introducing brokers and affiliates, KYC and identity verification providers, regulatory filings, onboarding documentation, and any other lawful channel through which a Data Subject interacts with the Company.

As of the date of this Policy, the Company has not yet commenced its regulated operations or launched its client-facing website and electronic systems. Accordingly, certain processing activities described in this Policy, including the collection and processing of personal data through the Company's website, client portal, trading platforms, and other client-facing systems, will become applicable upon the commencement of the Company's operations and the launch of such systems and services. The Company's official website address, email addresses, and other client-facing contact details will be incorporated into this Policy once they have been finalised and become operational in preparation for the launch of the Company's business.

3. Categories of Personal Data We Collect

The categories of personal data collected and processed by the Company will vary depending on the nature of an individual's relationship with the Company, the products or services requested, the Company's legal and regulatory obligations, and the stage of the business relationship (including pre-onboarding, onboarding, ongoing monitoring, and the termination of the relationship).

As of the date of this Policy, the Company has not yet commenced operations. Accordingly, certain categories of personal data described below will be collected and processed once the Company commences client onboarding and provides regulated services.

4. Sources of Personal Data

The Company may collect personal data directly from Data Subjects and from third parties, as permitted by applicable law, where such collection is necessary to establish and maintain a business relationship, comply with legal and regulatory obligations, protect the Company's legitimate interests, or provide its regulated services.

As of the date of this Policy, the Company has not yet commenced operations. Accordingly, certain sources of personal data described below will become applicable upon the commencement of client onboarding and the provision of regulated services.

5. Purposes and Lawful Bases of Processing Personal Data

The Company processes personal data only for specified, explicit, and legitimate purposes and only where there is a lawful basis for doing so under the Data Protection Act, 2023 and other applicable legal and regulatory requirements.

The lawful bases upon which the Company relies include:

• the performance of a contract;
• compliance with legal and regulatory obligations;
• the Company's legitimate interests;
• the protection of vital interests, where applicable;
• the performance of a task carried out in the public interest or under statutory authority, where applicable; and
• the consent of the Data Subject, where required.

As of the date of this Policy, the Company has not yet commenced operations. Accordingly, certain processing activities described below will become applicable upon the commencement of client onboarding and the provision of regulated services.

6. Recipients and Disclosure of Personal Data

The Company treats personal data as confidential and will only disclose personal data where such disclosure is lawful, necessary, proportionate, and consistent with the purposes set out in this Policy or where required or permitted by applicable law.

Personal data will only be shared with persons who have a legitimate business need to access such information and who are subject to appropriate confidentiality, contractual, legal, or regulatory obligations.

As of the date of this Policy, the Company has not yet commenced operations. Accordingly, certain disclosures described below will become applicable upon the commencement of the Company's regulated activities.

Personal data may be disclosed to the following categories of recipients:

7. International Transfers of Personal Data

As part of its business operations, the Company may transfer, store, access, or otherwise process personal data outside the Republic of Seychelles where this is necessary to provide its regulated services, comply with legal or regulatory obligations, utilise third-party service providers, or support the Company's operational and technological infrastructure.

As of the date of this Policy, the Company has not yet commenced operations. Accordingly, certain international transfers described in this section will occur upon the commencement of the Company's regulated activities.

International transfers may arise where personal data is disclosed to, or processed by:

• the Company's group companies and affiliated entities;
• cloud hosting and data storage providers;
• electronic identity verification and Know Your Customer ('KYC') providers;
• AML/CFT, sanctions, Politically Exposed Person ('PEP'), and adverse media screening providers;
• trading platform providers and technology service providers;
• payment service providers, banking institutions, and liquidity providers;
• professional advisers;
• regulators, supervisory authorities, and law enforcement agencies; or
• any other third-party service provider engaged by the Company.

Where personal data is transferred outside the Republic of Seychelles, the Company shall ensure that such transfers are carried out in accordance with the Data Protection Act, 2023 and that an appropriate level of protection is maintained.

Depending on the circumstances, the Company may rely on one or more of the following safeguards:

• transferring personal data to jurisdictions recognised as providing an adequate level of protection for personal data;
• entering into appropriate contractual safeguards with the recipient, including data processing agreements, standard contractual clauses, or other legally recognised transfer mechanisms;
• relying on binding corporate rules or equivalent safeguards where personal data is transferred within a corporate group;
• transferring personal data where necessary for the performance of a contract with the Data Subject or for the implementation of pre-contractual measures requested by the Data Subject;
• transferring personal data where necessary for the establishment, exercise, or defence of legal claims;
• transferring personal data where necessary to comply with legal or regulatory obligations or to protect the vital interests of a Data Subject or another person;
• obtaining the Data Subject's explicit consent where this is the appropriate lawful basis for the transfer; or
• relying on any other lawful transfer mechanism permitted under the Data Protection Act, 2023 or other applicable legal or regulatory requirements.

The Company shall take reasonable steps to ensure that all recipients of personal data outside the Republic of Seychelles maintain appropriate technical, organisational, and contractual safeguards to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, or destruction.

Where required by applicable law, the Company shall provide Data Subjects with further information regarding international transfers of their personal data and the safeguards implemented to protect such transfers upon request.

8. Data Retention

The Company shall retain personal data only for as long as is necessary to fulfil the purposes for which it was collected and processed, including to comply with applicable legal, regulatory, accounting, tax, audit, reporting, and record-keeping obligations.

Retention periods are determined having regard to the nature of the personal data, the purpose for which it was collected, applicable statutory and regulatory requirements, the Company's legitimate business needs, and any ongoing legal or regulatory proceedings.

Unless a longer retention period is required or permitted by law, the Company will generally retain personal data as follows:

• Customer Due Diligence ('CDD'), Enhanced Due Diligence ('EDD'), client onboarding documentation, client categorisation records, appropriateness assessments, source of funds and source of wealth documentation, account opening records, and transaction records shall be retained for a minimum period of seven (7) years following the termination of the business relationship, or for such longer period as may be required under the Anti-Money Laundering and Countering the Financing of Terrorism Act, 2020, the Securities Act, 2007 (as amended), the Securities (Conduct of Business) (Amendment) Regulations, 2024, or any applicable regulatory requirement.
• Telephone recordings, electronic communications, correspondence, trading instructions, order records, and other client communications shall be retained for a minimum period of seven (7) years, or such longer period as may be required by applicable law or the Financial Services Authority.
• Complaint records, complaint investigations, complaint correspondence, and complaint handling documentation shall be retained for a minimum period of seven (7) years following the final resolution or closure of the complaint, in accordance with the Financial Consumer Protection Act, 2022 and the Company's Complaints Handling Policy.
• Compliance monitoring records, internal investigations, breach and incident records, audit reports, governance records, conflict of interest records, and regulatory correspondence shall be retained in accordance with the Company's Record Keeping Policy and applicable legal and regulatory requirements.
• Marketing preferences and consent records shall be retained for the duration of the marketing relationship and for a reasonable period thereafter to demonstrate compliance with applicable legal requirements or until consent is withdrawn, where consent is relied upon as the lawful basis for processing.
• Employee, director, shareholder, and corporate governance records shall be retained for the period prescribed under applicable employment, corporate, tax, and regulatory legislation, or for such longer period as may be necessary to protect the Company's legal or regulatory interests.

Where the Company is subject to an ongoing investigation, litigation, regulatory inspection, audit, enforcement action, or legal hold, the relevant personal data may be retained beyond the applicable retention period until the matter has been fully concluded and any legal or regulatory obligations have been satisfied.

Upon expiry of the applicable retention period, and where there is no continuing legal, regulatory, or legitimate business reason to retain the personal data, the Company shall ensure that such data is securely deleted, destroyed, anonymised, or otherwise disposed of in accordance with the Data Protection Act, 2023, the Company's Record Keeping Policy, Internal Operations Manual, and secure information disposal procedures, so as to prevent unauthorised access, disclosure, reconstruction, or misuse.

9. Security of Personal Data

The Company is committed to protecting the confidentiality, integrity, availability, and resilience of the personal data it processes. The Company has implemented and maintains appropriate technical, organisational, and physical security measures designed to safeguard personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, misuse, or any other form of unlawful processing.

The Company's information security framework is designed with regard to the nature, scope, context, and purposes of the processing activities undertaken, the sensitivity of the personal data processed, the risks posed to Data Subjects, and the Company's legal and regulatory obligations.

The Company's security measures include, where applicable:

• role-based access controls and the principle of least privilege;
• multi-factor authentication for authorised users and privileged accounts;
• strong password management requirements and secure authentication controls;
• encryption of personal data during transmission and, where appropriate, whilst stored;
• secure firewalls, intrusion detection and prevention systems, endpoint protection, and anti-malware solutions;
• network monitoring, logging, and cybersecurity event management;
• regular software updates, security patching, and vulnerability management;
• penetration testing, vulnerability assessments, and periodic security reviews;
• secure backup procedures, disaster recovery arrangements, and business continuity measures;
• physical security controls protecting the Company premises, equipment, and records;
• secure disposal and destruction of records containing personal data;
• regular staff training and awareness programmes relating to data protection, cybersecurity, confidentiality, phishing, and information security;
• confidentiality obligations applicable to employees, directors, contractors, outsourced service providers, and other authorised persons;
• due diligence and ongoing oversight of third-party service providers that process personal data on the Company's behalf; and
• periodic reviews of the effectiveness of the Company's information security controls and data protection framework.

The Company shall regularly monitor and review its technical and organisational security measures to ensure that they remain appropriate, effective, and proportionate to the evolving cybersecurity threat landscape, technological developments, regulatory requirements, and the nature of the Company's business activities.

Where the Company becomes aware of a personal data breach, cybersecurity incident, or other event affecting the confidentiality, integrity, or availability of personal data, it shall investigate the incident promptly, implement appropriate containment and remediation measures, maintain appropriate records of the incident, and comply with any applicable notification obligations under the Data Protection Act, 2023 and other relevant legal or regulatory requirements.

Whilst the Company takes reasonable and appropriate steps to protect personal data using industry-recognised security standards and controls, no method of electronic transmission over the internet, cloud-based infrastructure, or electronic storage can be guaranteed to be completely secure. Accordingly, the Company cannot guarantee the absolute security of personal data, although it will continue to take all reasonable measures to minimise the risk of unauthorised access, loss, misuse, alteration, or disclosure.

10. Your Rights as a Data Subject

Subject to the provisions of the Data Protection Act, 2023, and any applicable legal or regulatory limitations, you have a number of rights in relation to the personal data that the Company processes about you.

These rights include:

• The right to be informed about how your personal data is collected, used, stored, disclosed, retained, and otherwise processed, including through this Privacy Policy.
• The right of access to obtain confirmation as to whether the Company processes your personal data and, where applicable, to request a copy of that personal data together with information regarding the purposes of processing, the categories of personal data processed, recipients, retention periods, and your applicable rights.
• The right to rectification to request the correction of inaccurate, incomplete, or outdated personal data held by the Company.
• The right to erasure ('right to be forgotten') to request the deletion of your personal data where there is no lawful basis for its continued processing or where applicable law otherwise requires its deletion.
• The right to restrict processing in circumstances permitted by applicable law, including while the accuracy of personal data is being verified or where processing is contested.
• The right to object to the processing of personal data carried out on the basis of the Company's legitimate interests and to object, at any time, to the processing of personal data for direct marketing purposes.
• The right to data portability, where applicable, to receive personal data you have provided to the Company in a structured, commonly used, and machine-readable format, and to request that such data be transmitted to another controller where technically feasible.
• The right to withdraw consent at any time where the Company relies on your consent as the lawful basis for processing. Withdrawal of consent shall not affect the lawfulness of any processing carried out before consent was withdrawn.
• The right not to be subject solely to automated decision-making, including profiling, where such processing produces legal effects concerning you or similarly significantly affects you, except where permitted by applicable law.
• The right to lodge a complaint with the Information Commission of Seychelles or any other competent supervisory authority if you believe your personal data has been processed unlawfully.

To exercise any of these rights, please submit your request to the Company's Compliance Officer or designated privacy contact using the contact details set out in Section 16 of this Policy.

The Company will respond to requests within the timeframes prescribed by applicable law. Where permitted by law, the Company may request additional information to verify your identity before responding to a request. The Company may also decline or restrict a request where permitted or required by law, including where compliance with the request would prejudice regulatory obligations, legal proceedings, investigations, or the rights and freedoms of others.

11. Automated Decision-Making and Profiling

To support the efficient, consistent, and compliant delivery of its regulated services, the Company may utilise automated processing, profiling, and technology-assisted decision-making as part of its client onboarding, regulatory compliance, fraud prevention, cybersecurity, and ongoing risk management activities.

Automated processing assists the Company in meeting its obligations under the Data Protection Act, 2023, the Securities Act, 2007 (as amended), the Securities (Conduct of Business) (Amendment) Regulations, 2024, the Anti-Money Laundering and Countering the Financing of Terrorism Act, 2020, and other applicable legal and regulatory requirements.

Automated processing may be used for purposes including:

• electronic identity verification and customer due diligence;
• sanctions screening;
• Politically Exposed Person ('PEP') screening;
• adverse media and reputational screening;
• fraud detection and fraud prevention;
• transaction monitoring and suspicious activity detection;
• cybersecurity monitoring and threat detection;
• client risk assessment and risk rating;
• Retail and Professional Client categorisation;
• appropriateness assessments for speculative or complex financial products, where applicable;
• monitoring unusual account activity or behavioural patterns; and
• supporting the Company's internal compliance, governance, and risk management framework.

Automated processing enables the Company to identify potential risks, comply with applicable legal and regulatory requirements, strengthen the security of its systems, detect suspicious or fraudulent activity, and improve the efficiency and consistency of its operational processes.

The Company recognises that automated processing may, in certain circumstances, significantly affect a Data Subject or produce legal or similarly significant effects. Accordingly, where such automated processing is used, the Company shall implement appropriate safeguards, including:

• ensuring that automated decisions are supported by appropriate governance and oversight arrangements;
• making meaningful human review available before a final decision is implemented where required by applicable law;
• allowing relevant information to be reviewed and, where appropriate, reconsidered by suitably authorised personnel;
• ensuring that automated processing is regularly monitored, tested, and reviewed for accuracy, fairness, consistency, and regulatory compliance; and
• maintaining appropriate records of automated decision-making processes in accordance with the Company's governance and record-keeping framework.

A Data Subject has the right, subject to applicable law, to request further information regarding any automated processing or profiling undertaken by the Company, to request human intervention where appropriate, to express their point of view, and to challenge or request a review of any decision based solely on automated processing where such decision produces legal effects or otherwise significantly affects them.

The Company shall ensure that any automated processing or profiling is carried out in a fair, transparent, proportionate, and secure manner, and only to the extent necessary to achieve legitimate business purposes or to comply with applicable legal and regulatory requirements.

12. Cookies and Similar Technologies

Upon the launch of the Company's website, client portal, mobile application, trading platforms, and other client-facing electronic systems, the Company may use cookies, web beacons, pixels, software development kits ('SDKs'), and similar technologies (collectively referred to as 'Cookies') to improve the functionality, security, performance, and user experience of its digital services.

Cookies are small text files placed on a user's device that enable the Company to recognise returning users, maintain secure sessions, remember user preferences, analyse website usage, improve system performance, and support the delivery of certain online services.

The Company may use both session cookies, which expire automatically when the user's browser is closed, and persistent cookies, which remain on the user's device until they expire or are manually deleted.

The Company may also use first-party cookies (set directly by the Company) and, where appropriate, third-party cookies provided by carefully selected service providers that support the operation, security, analytics, or functionality of the Company's digital platforms.

Cookies may be used for purposes including:

• enabling essential website and platform functionality;
• authenticating users and maintaining secure login sessions;
• preventing fraud, account compromise, and unauthorised access;
• supporting cybersecurity monitoring and incident detection;
• remembering user preferences and account settings;
• improving website and platform performance;
• analysing website traffic, system usage, and user behaviour to improve the Company's services;
• measuring the effectiveness of communications and marketing activities, where permitted by applicable law;
• supporting the operation of the client portal, trading platforms, and mobile applications; and
• enhancing the overall user experience.

The Company shall classify Cookies according to their purpose and shall distinguish between strictly necessary Cookies, which are required for the operation and security of the Company's website and services, and non-essential Cookies, including analytical, functional, and marketing Cookies.

Where required by the Data Protection Act, 2023, or any other applicable law, the Company shall obtain the user's prior consent before placing non-essential Cookies on their device. Users may withdraw or modify their Cookie preferences at any time through the Company's Cookie Management Tool, once available, or by adjusting their browser settings.

Please note that disabling certain Cookies may affect the functionality, security, or availability of certain features of the Company's website, client portal, trading platforms, or other electronic services.

The Company may retain information collected through Cookies only for as long as necessary to fulfil the purposes for which it was collected, in accordance with this Privacy Policy, the Company's Record Keeping Policy, and applicable legal and regulatory requirements.

Further information regarding the categories of Cookies used by the Company, their purposes, retention periods, and how users can manage their Cookie preferences will be set out in the Company's Cookie Notice, which will be published on the Company's website upon commencement of operations.

13. Marketing Communications

The Company may, where permitted by applicable law, communicate with existing or prospective clients regarding its products, services, educational material, market updates, regulatory developments, events, promotions, or other information that may be relevant to the Company's regulated business.

All marketing communications issued by the Company shall comply with the Data Protection Act, 2023, the Securities Act, 2007 (as amended), the Securities (Conduct of Business) Regulations, 2008, as amended by the Securities (Conduct of Business) (Amendment) Regulations, 2024, and any applicable guidance, directives, or requirements issued by the Financial Services Authority ('FSA'). The Company shall ensure that all marketing and promotional communications are fair, clear, accurate, balanced, and not misleading.

Marketing communications may be provided through various lawful communication channels, including:

• email;
• telephone;
• SMS or other text messaging services;
• the Company's website;
• the client portal (upon commencement of operations);
• mobile applications;
• electronic messaging platforms; or
• any other lawful means of communication authorised by the recipient or permitted by applicable law.

Where the Company relies on consent as the lawful basis for sending marketing communications, such consent shall be obtained prior to sending those communications and shall be freely given, specific, informed, and capable of being withdrawn at any time.

Recipients may withdraw their consent or opt out of receiving marketing communications at any time by:

• selecting the unsubscribe facility contained within the relevant communication;
• updating their communication preferences through the Company's client portal, once operational;
• contacting the Company's Compliance Officer or designated privacy contact using the contact details set out in this Policy; or
• using any other opt-out mechanism made available by the Company.

The Company shall maintain appropriate records of marketing preferences, consents, withdrawals of consent, and opt-out requests to demonstrate compliance with applicable legal and regulatory requirements.

Withdrawal of consent or opting out of marketing communications shall not affect the Company's ability to send communications that are necessary to:

• administer or maintain the business relationship;
• comply with legal, regulatory, or licensing obligations;
• provide contractual, operational, security, or account-related information;
• notify clients of changes to the Company's products, services, terms and conditions, or policies; or
• communicate information that the Company is required to provide under applicable law or regulation.

The Company shall not sell or disclose personal data to third parties for their own direct marketing purposes without the Data Subject's prior consent, unless otherwise permitted or required by applicable law.

14. Children's Privacy

The Company's regulated products and services are intended exclusively for individuals who have attained the age of eighteen (18) years, or such higher minimum age as may be prescribed under applicable law or regulatory requirements. The Company does not knowingly establish business relationships with, provide regulated financial services to, or market its products or services directly to individuals who do not meet the applicable minimum age requirements.

As part of its client onboarding procedures, the Company undertakes identity verification, age verification, client categorisation, and appropriateness assessments in accordance with the Securities (Conduct of Business) (Amendment) Regulations, 2024, together with Customer Due Diligence ('CDD') procedures under the Anti-Money Laundering and Countering the Financing of Terrorism Act, 2020, to ensure that applicants satisfy the Company's eligibility criteria and regulatory requirements before a business relationship is established.

The Company does not knowingly collect, use, process, retain, or disclose personal data relating to children. If the Company becomes aware, or has reason to believe, that personal data belonging to a child has been collected or processed inadvertently, it shall take prompt and appropriate steps to:

• verify the circumstances surrounding the collection of the personal data;
• suspend any further processing of the personal data where appropriate;
• securely delete, anonymise, or otherwise lawfully dispose of the personal data, unless its retention is required or permitted by applicable law;
• take appropriate measures to prevent the recurrence of such collection; and
• where required or appropriate, notify the child's parent or legal guardian and any competent authority in accordance with applicable legal or regulatory requirements.

Parents, legal guardians, or other persons who believe that a child has provided personal data to the Company are encouraged to notify the Company immediately using the contact details set out in this Privacy Policy. Upon receipt of such notification, the Company will promptly investigate the matter and take appropriate action in accordance with the Data Protection Act, 2023 and any other applicable legal or regulatory requirements.

The Company remains committed to protecting the privacy and personal data of all individuals and shall ensure that any personal data relating to children is handled with the highest degree of care and in accordance with applicable law.

15. Changes to this Privacy Policy

The Company may review, amend, or update this Privacy Policy from time to time to ensure that it remains accurate, effective, and consistent with applicable legal and regulatory requirements, industry best practices, and the Company's business operations.

This Privacy Policy may be updated to reflect, among other things:

• changes to applicable laws, regulations, codes, or guidance, including the Data Protection Act, 2023, the Securities Act, 2007 (as amended), the Anti-Money Laundering and Countering the Financing of Terrorism Act, 2020, the Financial Consumer Protection Act, 2022, or any other applicable legislation;
• new guidance, directives, circulars, licence conditions, or supervisory expectations issued by the Financial Services Authority, the Information Commission, the Financial Intelligence Unit, or any other competent authority;
• changes to the Company's business activities, organisational structure, products, services, technology, systems, outsourcing arrangements, or methods of processing personal data;
• the introduction of new technologies, trading platforms, client portals, mobile applications, websites, or other digital services;
• changes arising from risk assessments, data protection impact assessments, cybersecurity reviews, internal or external audits, regulatory inspections, or compliance monitoring activities;
• improvements to the Company's privacy governance framework, security controls, policies, procedures, or operational practices; or
• any other development that materially affects the manner in which the Company collects, uses, stores, discloses, transfers, retains, or otherwise processes personal data.

This Privacy Policy shall be reviewed periodically by the Compliance Officer, and any material amendments shall be submitted to the Board of Directors for approval prior to implementation.

The most current version of this Privacy Policy shall be made available on the Company's website upon commencement of operations and may also be provided to Data Subjects upon request.

Where the Company makes material changes that affect the manner in which personal data is processed or the rights of Data Subjects, the Company will take reasonable steps to notify affected Data Subjects using appropriate communication channels, which may include email, notices published on the Company's website, notifications through the client portal (once operational), or any other method considered appropriate in the circumstances.

The date of the most recent revision shall be stated in this Privacy Policy. Continued engagement with the Company or continued use of the Company's services following the effective date of any revised Privacy Policy shall constitute acknowledgement of the updated Policy, except where applicable law requires the Company to obtain the Data Subject's express consent before implementing specific changes.

16. Contact Details and Complaints

Questions, requests, or complaints relating to this Privacy Policy or the processing of personal data should be directed to the Company's Compliance Officer or designated privacy contact.

Keytech Limited
CT House, Office 9A
Providence
Mahé
Republic of Seychelles

Email: support@elev8.com

The Company will acknowledge and investigate privacy-related enquiries and complaints promptly and fairly and will seek to resolve them in accordance with applicable legal and regulatory requirements.

If you remain dissatisfied with the Company's response, or believe that your personal data has been processed in breach of the Data Protection Act, 2023, you have the right to lodge a complaint with the Information Commission of Seychelles, being the authority responsible for administering and enforcing the Data Protection Act, 2023.

Information Commission of Seychelles
P.O. Box 1342
Victoria, Mahé
Republic of Seychelles
Telephone: (+248) 431 3088

You may also contact the Information Commission through its official website: Information Commission of Seychelles.