Demeter Investment Holdings ("Demeter", "We", "Our" or "Us") is committed to respecting individual privacy and ensuring the protection of personal data in accordance with the applicable data protection laws in the jurisdictions where Demeter operates, including but not limited to UAE, United Kingdom and Cayman Islands. This Data Privacy Statement ("the Statement") outlines how Demeter, as a data controller, collects and uses personal data.

natural person Any reference to "You" or "Your" in this Statement includes: (a) A natural person who may be a client, prospective client, supplier, business partner, or introducer; or (b) A who may be a director, officer, staff member, shareholder, or beneficial owner of a prospective client, client, supplier, business partner, or introducer ("connected individual").

We kindly request that You make this notice available to anyone whose data We may obtain in the context of Our relationship with You or Your organization.

1. Applicability

This Statement applies to natural persons and connected individuals whose personal data We collect. It outlines Our practices when using personal data in the context of business relationships with prospective clients, clients, suppliers, business partners, or introducers with whom Demeter provides or receives any product or service, and/or enters any transaction.

2. Key Terms Explained

Term

Definition

Personal Data

Any data or information relating to an identified or identifiable natural person. This includes, but is not limited to, an individual's name, age, address, financial information, and employment details.

Sensitive Personal Data

Personal Data revealing or concerning an individual's racial or ethnic origin, political opinions, religious beliefs, criminal record, or health and sex life.

Identifiable Natural Person

A natural person who can be identified, directly or indirectly, by reference to an identification number or factors specific to his biological, physical, biometric, physiological, mental, economic, cultural, or social identity.

Data Subject

A natural person to whom Personal Data relates.

Data Processor

Any person or entity that processes Personal Data on behalf of a Data Controller. This includes outsourced service providers, business partners, introducers, and group entities.

Processing

Any operation performed on Personal Data, such as collection, storage, use, disclosure, or deletion.

Recipient

Any person or entity to whom Personal Data is disclosed.

Third Party

Any person other than the Data Subject, Data Controller, Data Processor, and those under the direct control of the Data Controller or Data Processor.

3. Who is responsible for handling Your personal data?

As the Data Controller, Demeter Investment Holdings and its affiliated group companies are responsible for handling Your personal data in compliance with the applicable data protection laws of the jurisdictions where they operates. If You wish to exercise Your rights, or raise any questions, concerns, or complaints regarding this Statement or Our data protection practices, You can contact Us at:

Email: operations@demeterinvestment.com

Telephone: +1 345 949 8066

4. What personal data might We hold about You and where do We source such data?

We will only hold personal data relevant to the business relationship We have with You or entities where You are considered a connected individual. This data is primarily obtained directly from You but may also be sourced from other entities, public sources, and business-risk screening services.

The types of personal data We process include (but are not limited to):

Contact Information: Name, address, telephone number, email, etc.

KYC Records: Identification details, nationality, marital status, etc.

Financial Information: Source of wealth, income, investments, etc.

Communications: Emails, recordings of calls, etc.

5. What will We use Your personal data for and on what legal basis?

Demeter processes Your personal data for various purposes under the lawful bases outlined in the data protection laws of the jurisdictions where Demeter operates, including:

For the performance of a contract: To provide advisory and financial services.

For compliance with the applicable law: To fulfill legal and regulatory obligations.

For legitimate interests: To manage risks, optimize efficiency, and prevent fraud.

Based on Your consent: Where applicable, for processing sensitive personal data.

6. Who We share personal data about You with?

Where necessary, We may share Your personal data with:

Our affiliated group companies

Credit reference and third-party agencies

Business partners and service providers

Professional advisers (e.g., auditors, lawyers)

Competent authorities as required by law

We will only disclose Your personal data as permitted under the applicable data protection laws.

7. Where might We transfer Your data?

We may transfer Your personal data to servers or databases outside the jurisdiction where it was collected, including but not limited to the United Arab Emirates, the United Kingdom, Europe, USA and Canada. Such transfers will only be made in compliance with the relevant data protection laws, and We will ensure that the same level of protection is applied to Your data.

8. How long do We store personal data for?

We will retain Your personal data for as long as necessary to fulfill the purposes for which it was collected, in line with legal and regulatory obligations. This period may extend beyond the duration of Our relationship with You to comply with record-keeping requirements.

9. What are Your rights in relation to personal data?

You have certain rights concerning Your personal data, including the rights to:

OAccess: Request access to Your personal data.

Withdraw Consent: Withdraw consent at any time.

Correction: Request correction of incomplete or inaccurate data.

Erasure: Request deletion of personal data in certain circumstances.

Objection: Object to processing based on legitimate interests.

Restriction: Request restriction of processing.

Portability: Request transfer of data to another party.

Right to lodge a complaint: Lodge a complaint with the relevant data protection authority.

10. Marketing communications

We may use Your personal data to inform You about Our products and services. You can opt out of receiving marketing communications at any time by contacting Us.

10. Marketing communications

You are not required by law to provide Us with Your personal data, but refusing to do so may limit Our ability to conduct business with You.

11. Are You under an obligation to provide Us with Your personal data?

This Statement may be amended from time to time. Any amendments will take effect on the date specified in the updated Statement, which will be issued to clients.

12. Amendments to this Statement

You are not required by law to provide Us with Your personal data, but refusing to do so may limit Our ability to conduct business with You.

Disclosure

The information provided is for general purposes only and does not constitute professional advice. Any reliance on this information is at your own risk. We are not responsible for any errors or omissions in the content.

Location
PO BOX 309, Ugland House,
Grand Cayman, KY1-1104,
Cayman Islands
© Copyright 2025 All rights reserved by DEMETER