How Caibull Markets handles personal information.

Effective date: 22 September 2026

1. Controller and contact

Caibull Markets, Company No. C186708, is the controller for the processing described in this notice. Its registered office is C/o AllServ Management Ltd, Office 15, Floor 1, CentrePoint, Trianon, Mauritius.

Privacy and data-rights enquiries may be sent to compliance@caibull-markets.com.

2. Information we may process

Depending on how you interact with us, we may process identity and contact details; organisation, role and authority information; correspondence and enquiry content; regulatory, classification and due-diligence information; account, transaction and service records; device, browser, security and access logs; preferences and consent records; and information required by law, contract or risk-management procedures.

Please do not send identity documents, credentials, payment-card information or trading instructions to a general website email address. Where sensitive information is required, we will provide an approved secure route.

3. Purposes and legal grounds

We may process personal information to respond to enquiries; assess eligibility; establish and administer a business relationship; provide, secure and improve services; verify identity, authority and ownership; prevent fraud and misuse; manage risk; keep records; exercise or defend legal rights; meet regulatory, tax, accounting, sanctions, anti-money-laundering and other legal obligations; and send service or business communications where permitted.

The applicable legal ground may include taking steps at your request before a contract, performance of a contract, compliance with legal obligations, our legitimate interests or those of another person, consent where required, and the establishment, exercise or defence of legal claims.

4. Sources and disclosure

Information may come from you, your organisation and authorised representatives; public registers and professional sources; regulators, screening and verification providers; financial institutions, trading and technology providers; counterparties; advisers; and service providers.

We may disclose information where reasonably necessary to group companies and personnel, professional advisers, auditors, insurers, banks, platform and technology providers, verification and screening providers, authorities, regulators, courts, law-enforcement bodies, prospective transaction parties and other recipients authorised by you or permitted by law. Recipients may act as processors or independent controllers depending on their role.

5. International transfers

The recipients and systems used to provide services may be located outside Mauritius or your country. Where required, we use an available lawful transfer mechanism and appropriate contractual, organisational or technical safeguards, taking account of the destination and the nature of the information.

6. Retention

We retain information for as long as reasonably required for the purpose collected and to meet legal, regulatory, accounting, risk, security, dispute and recordkeeping requirements. Retention periods vary by record type, relationship, jurisdiction and applicable limitation period. Information may be retained longer where a legal hold, investigation or dispute requires it, and securely deleted or anonymised when no longer required.

7. Security and your responsibilities

We use proportionate technical and organisational measures intended to protect personal information. No internet or storage system is completely secure. You must protect credentials, use approved communication channels and tell us promptly if you suspect unauthorised access or a fraudulent communication.

8. Your rights

Subject to applicable law and relevant exceptions, you may have rights to request information and access; correction; erasure; restriction; objection; data portability; withdrawal of consent; and review of certain automated decisions. We may need to verify your identity and authority before acting. You may also complain to the Mauritius Data Protection Commissioner or another competent supervisory authority.

9. Website data and cookies

The website processes essential technical logs and stores a first-party preference record required for security, delivery, operation and remembering your privacy choices. If Google Tag Manager is enabled, optional analytics and advertising technologies remain blocked until you grant the corresponding permission. You may reject optional technologies and change your choice at any time through Cookie preferences in the footer.

10. Changes

We may update this notice to reflect changes in law, services, systems or processing. The effective date shown above identifies the current website version. Material changes may be communicated through the website or another appropriate channel.