Website privacy, cookie and data use policy

PRIVACY POLICY

*PLEASE READ THIS POLICY CAREFULLY BEFORE REGISTERING FOR AN ACCOUNT WITH US*

Date last revised: 22/02/2024

Maydan Capital Ltd trading as "WahedX" and "Wahed Ventures",(we/us/our/Wahed Ventures) are committed to protecting and respecting your personal data and your privacy. We recognise that your personal data is your property and that you have provided it to us for specific purposes.

Unless otherwise required by law, the Information Commissioner’s Office (ICO) guidance or best practice, or in order to perform our contract with you, we will only process your personal data in the way we tell you or in the way you ask us to, and we will give it back to you at any time.

1. THIS POLICY

1.1 1.1 This policy, together with the Investor Terms & Conditions, which are made available to investors, explains how any personal data we collect from you, or that you provide to us, will be processed by us or any processor on our behalf.

1.2 This policy applies to our contract with you. You are therefore advised to read it carefully. Terms used within it shall have the meaning(s) given in the Data Protection Act 2018 (Act) and/or the General Data Protection Regulation (Regulation), as applicable

1.3 By visiting our website located at portal.wahedx.com (our Website), or by registering for an account with us, you accept and consent to the practices described in this policy.

1.4 Any changes we make to this policy will be posted on this page. You are advised to check back frequently as any changes will be binding on you when you continue to use the Website after the date of the relevant change.

1.5 For more information relating to your rights under this policy, please see section 11.

1.6 If you have any queries relating to this policy, please contact us at support.ventures@wahed.com

2. WHO WE ARE

2.1 We are Maydan Capital Ltd trading as "WahedX" and "Wahed Ventures",(we/us/our/Wahed Ventures), a company registered in England and Wales (Company No. 13451691). Ourregistered address is: 87-89 Baker Street, London, England, W1U 6RJ, UK. We operate the Website and we are the data controller for the purposes of the Act and the Regulation.

2.2 We are registered with the ICO to process your personal data and our registration number is ZB160747. .

2.3 Your data will be processed on our behalf by ShareIn Limited, a company registered in Scotland (number SC408803) with its registered office on the Suite 2, Ground Floor Orchard Brae House, 30 Queensferry Road, Edinburgh, United Kingdom, EH4 2HS (ShareIn). ShareIn hosts our Website and will be the data processor for the purposes of the Act.

2.4 Your data will be held by ShareIn on their secure servers located in the Republic of Ireland, but will be processed by staff who work in the UK.

2.5 The Website is hosted by ShareIn Limited which uses the Twilio SendGrid email platform when sending email. All of SendGrid's email servers are in the USA and as such Personal Data is being sent to (and stored in) the USA.

2.6 Your data will also be processed on our behalf by Thompson Taraz Depositary Limited (“TTDL”) , a limited liability partnership registered in England and Wales under number OC307438.The registered office address is 4th Floor, Stanhope House, 47 Park Lane, London, W1K 1PR.

2.7 We operate on the terms of a written agreement with ShareIn relating to your personal data.

2.8 Any payment transactions you make through our Website will be made through our approved third party payment gateway, encrypted through SSL technology. ShareIn are a joint controller in respect of any personal data provided to them and any of your personal data they hold will be subject to this privacy policy.

3. YOUR CONSENT

3.1 By registering for Account and/or otherwise using the Website, you expressly consent to:

3.2 You may withdraw your consent under 3.1 at any time. However, where the withdrawal of your consent prevents us or ShareIn from verifying your identity or otherwise monitoring who you are, you will be unable to use your Account and make Investments through our Website OR You may exercise your rights under 3.1 at any time, which includes withdrawing your consent to our processing of your personal data. However, where this withdrawal prevents us from performing our contract with you, we may not be able to provide our goods and services to you.

3.3 International Data Transfers
Your personal data will only be stored or transferred within the UK, EU or US using standard contractual clauses, or other safeguards that have been approved by the relevant regulatory body.

4. WHAT WE COLLECT

4.1 We may collect all or some of the following categories of data from you:

• Title
• Full name
• Address (including postcode)
• Date of Birth
• Email address
• Nationality
• Bank Account details
• IP address
• Passport (including passport number)
• Driving Licence (including driving licence number)
• Risk questionnaire answers
• Investment experience and sources of wealth

4.2 When you make an Investment, you will be required to provide your identity document to allow ShareIn to satisfy its Know Your Customer (KYC) regulatory requirements. Any associated personal data contained on that document will be retained by us or ShareIn (from time to time).

4.3 In addition to the above, we will also provide you with your Account Details, which includes your username which is either created by, or assigned to, you. The Account Details should be remembered by you, but will be stored by us in case you forget them.

5. HOW WE COLLECT YOUR DATA

The data listed in section 4 is collected in the following ways:

5.1 By your Interactions with us –

• Registering for an account: this is any information you give to us that we request from you when signing-up for an Account to use our Website.
• Apply for our products or services;
• Subscribe to our service or publications;
• Request marketing to be sent to you;
• Enter a competition, promotion or survey; or
• Give us feedback or contact us.

5.2 Information collected – each time you visit our Website, whether through your home, work or a public network, your own computer or mobile device, ShareIn will automatically collect:

5.3 Received from third parties – we and ShareIn verify your eligibility to make an Investment and any payment you wish to make.

5.4 Automated technologies or interaction -

• Amazon Web Services
• AppsFlyer
• Onfido
• Google Analytics
• Companies House
• Wealthkernel
• Plaid Inc
• ShareIn Limited
• Thompson Taraz Depositary Limited

6. WHAT WE DO WITH YOUR DATA

6.1 Your data is primarily necessary to verify who you are when accessing your Account and to ensure you meet our eligibility requirements in order to submit an Application and make an Investment

6.2 Additionally, we or ShareIn will use all of your data you provide us to notify you about:

6.2.1 similar Projects or Properties listed on our Website that are similar to those you have already Invested in, or otherwise viewed or enquired about; or

6.2.2 changes to our Website or our services.

6.3 We or ShareIn use any data we collect about you (as a result of your visit to our Website) to:

6.4 Where we change our services, or any applicable terms and conditions, we will contact you.

6.5 Any data we obtain about you from third parties are used for the purposes of verifying your eligibility to submit an application and to make an investment through our Website, and are acquired only to the extent we are unable to do so as a result of the information you provide to us.

6.6 Once collected, we and/or ShareIn may retain your data for up to six years following the date of your last Investment or the date you close your Account (whichever is the later). This is to enable us to refer back to any transactions or records you are involved in (should we be required to do so).

6.7 We also collect, use and share aggregated data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals' Usage Data to calculate the percentage of users accessing a specific website feature in order to analyse general trends in how users are interacting with our website to help improve the website and our service offering.

7. HOW AND WHY WE DISCLOSE YOUR DATA

7.1 Subject to the rest of part 7 of this policy, we or ShareIn will only disclose your personal data to the following third parties for the following purposes:

7.2 In addition to the transfers contemplated by part 7.1, we or ShareIn may transfer or disclose your personal data to:

7.3 Any websites which are linked from the Website are outside of our control and not covered by this policy. If you access those websites using the links provided, the website operators may collect information from you which will be used by them in accordance with their own privacy policies (if any). These policies may differ from ours, and we cannot accept any responsibility or liability in respect of these.

8. WHY WE NEED TO COLLECT YOUR DATA

Wahed is required under General Data Protection Regulation 2016/679 to explain the lawful basis of processing of your information.

We collect this information primarily to satisfy legal requirements and to enable us to provide the services required under your contract with us.

GDPR Article 6 (1) Lawfulness of processing requires:

Processing shall be lawful only if and to the extent that at least one of the following applies:

• the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
• processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
• processing is necessary for compliance with a legal obligation to which the controller is subject;
• processing is necessary in order to protect the vital interests of the data subject or of another natural person;
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

8.1 The types of lawful basis we rely upon are:

Legal, for example verifying your identity or complying with regulatory obligations, such as MiFID II.

Contract and legitimate interest, for example your email address and telephone number to contact you.

Consent, for example implicit consent would be the collection of your payment information for an optional service and explicit consent is for marketing or health information (special category data).

Vital interest, for example if the account holder passes away, we’re required to liaise and allow access to the next of kin.

Where explicit consent is required we will seek this from you, for example Marketing preferences and Pension. In order for Wahed to provide you with a Personal Pension, we’re required to gather some health information, this is a special category under GDPR and therefore requires explicit consent.

However, in the vast majority of cases explicit consent is not required, and implicit consent is inferred to perform our responsibilities under the contract.

Where explicit consent is required and not provided it may result in non-benefit of service, or the inability to open an account with Maydan Capital Ltd as "WahedX" and "Wahed Ventures"

9. COOKIES

9.1 Our Website will use the cookies listed in section 6.2 (alpha-numeric text files placed on your computer) to:

9.2 The following cookies are set to our Website for the listed purposes:

• ASP.Net_SessionId: Enhances user experience by remembering session history
• AS-XAUTH: records users authentication session
• _culture: assists in recognising user’s nationality and language preferences , login, token, username recognition and encoding
• RequestVerificationToken: part of a mechanism to protect against cross site scripting attacks
• ARRAffinity: enhances user browsing experience - part of load balancing setup
• cookie-policy: tracks presentation of the cookie information advice

9.3 Our Website additionally uses Google Analytics, a web analytics service provided by Google, LLC (Google). Google Analytics uses analytical, performance or targeting cookies to help analyse how you use the Website and compile reports on your activity for us.

9.4 Any information generated by the cookie about your use of the Website (including your IP address) will be transmitted to, and stored by, Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the Website, compiling reports on your activity for us and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google.

9.5 You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this your ability to use the Website may be restricted. By using the Website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.

9.6 You may refuse the use of cookies by selecting appropriate settings on your browser. However, if you do so, your ability to use the Website may be restricted.

9.7 Except for essential cookies, all cookies will expire after your session.

10. SECURITY

10.1 We are committed to ensuring that your information is safe and secure. In order to prevent unauthorised access or disclosure, we utilise physical, electronic and managerial procedures to safeguard and secure the information we collect.
There is also a lot that you can do to help us keep your account safe. We recommend that you take the following actions:
Do not disclose your login and password details with anyone and don't store them on your device(s). If you feel someone may know your login details or if you lose your device then contact us immediately to prevent unauthorised access to your account.
Access your account using the best security offered by your browser to maintain the security of your account, this for example would be incognito for Google Chrome and Private browser for Safari.
If possible, keep your device’s operating system updated with the latest security patches and upgrades. Older software may have security vulnerabilities that could expose you to additional risks. You may also want to consider using a reputable brand of anti-virus software.

10.2 We have put in place appropriate technical and organisational measures to help protect your personal information from unauthorised access, use, disclosure, alteration or destruction consistent with applicable Data Protection Laws.

10.3 Each member of staff has unique log-in details and authentication software requires these to access the systems. Staff have access to personal data only for the purposes of performing their roles.

10.4 We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

11. YOUR RIGHTS

11.1 In relation to all of your personal data, you have the following rights to ask us or ShareIn (in addition to any rights you may have under the Act or the Regulation):

11.2 Your Rights Subject Access Request
You’re entitled under the GDPR Article 15 ‘right of access’ to request the personal data that Wahed Invest holds on you. You can request a copy of this information by emailing support.ventures@wahed.com
If you believe that any information we are holding on you is incorrect or incomplete, please write to or email us as soon as possible, at the above address. We will promptly correct any information found to be incorrect.

11.3 The Right to Erasure
You’re entitled under the GDPR Article 17 ‘right to erasure’ to request the deletion of personal data that Wahed Invest and our third parties hold on you. You can request this by emailing support.ventures@wahed.com
Please note, this does not affect any information required to be stored under record retention laws, more information on the retention period is set out below.

11.4 Retention Period
We will retain your personal data only for as long as necessary to fulfil the purposes outlined in this Policy or as required by law. Once Wahed has obtained your personal data, it will be maintained securely in Waheds system for the period necessary to fulfil the purposes for which the data was collected (see above). Once a Registered User, you may terminate your membership of the App by contacting Wahed (suppor.ventures@wahed.com).
Wahed may retain your personal data even after you have closed your account if retention is reasonably necessary to comply with our legal obligations, meet regulatory requirements, resolve disputes between users, prevent fraud and abuse, or enforce this Privacy Policy and other relevant terms. Once your personal data is no longer required, we will securely delete or anonymise it.

11.5 How to change your privacy preferences
You can change your preferences, or withdraw your consent in relation to how Wahed Invest uses your personal information in one of the following ways:
You are also able to request information about your data stored at Wahed Invest as well as request the correction, deletion or restriction of your personal data for analytics and/or marketing use.

• By sending an email to support.ventures@wahed.com
• Or by writing to us at:
  87-89 Baker Street,
  London,
  W1U 6RJ,
  United Kingdom

Under certain conditions you have the right to require us to:

• Provide you with further detail on the use we make of your information
• Provide you with a copy of your information
• Update any inaccuracies in the information we hold about you
• Delete any information about you that we no longer have a lawful ground to use
• Remove you from any direct marketing lists when you object or withdraw your consent
• Provide you with your personal information in a usable electronic format and transmit it to a third party (right to data portability)
• Restrict our use of your personal information
• Cease carrying out certain processing activities based on the legitimate interests ground unless our reasons for undertaking that processing outweigh any prejudice to your data protection rights.

Your exercise of these rights is subject to certain exemptions to safeguard the public interest e.g. the prevention or detection of crime (GDPR Article 6 (1) (e)).

If you are dissatisfied with our use of your information or our response to any exercise of these rights you have the right to complain to your data protection authority, this in the UK is the Information Commissioner's Office (ICO) https://ico.org.uk. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

11.6 If you wish to exercise any of your rights at any time, please contact us on the details contained at the beginning of this policy in the first instance. We will require you to verify your identity to us before we provide any personal data, and reserve the right to ask you to specify the types of personal data to which your request relates.

11.7 Where you wish to exercise any of your rights, they may be subject to payment of a nominal administration fee (to cover our costs incurred in processing your request) and any clarification we may reasonably require in relation to your request. Such fees may be charged where we consider (acting reasonably) that your request is excessive, unfounded or repetitive.

11.8 Any data provided to you in accordance with your rights will be in a structured and machine-readable form.

11.9 Equity investments are not readily realisable and involve risks, including loss of capital, illiquidity, lack of dividends and dilution, and it should be done only as part of a diversified portfolio. Investments of this type are only for investors who understand these risks. You will only be able to invest in the company once you have met our conditions for becoming a registered member.

12. CONTACT DETAILS

If you would like to contact us regarding our Privacy Policy, please contact us via:

PLEASE CLICK HERE TO READ THE FULL RISK WARNING

Maydan Capital Ltd trading as "WahedX" and "Wahed Ventures",(we/us/our/Wahed Ventures) is registered in England and Wales (Company No. 13451691), registered office: 87-89 Baker Street, London, England, W1U 6RJ, UK. Maydan Capital Ltd (FRN: 963613) is an appointed representative of Wahed Invest Ltd (FRN: 833225), an authorised and regulated firm by the Financial Conduct Authority.

Updated on 22/02/2024