1. Introduction

This Privacy and Cookie Policy describes how we SCapital collects, uses, stores and protects personal data.

This policy applies to all users of the platform and ensures compliance with current data protection regulations, including GDPR and the UK GDPR.

This section provides practical legal interpretations, illustrates the operational implications under the GDPR and the UK GDPR, and describes SCapital's commitments regarding the management of user data. It also presents concrete examples, illustrates data flows into and out of the platform, and describes the protection measures applied at each stage. Compliance documentation and audit procedures are performed regularly to ensure regulatory compliance.

2. Company Information

SCapital is a company registered in the United Kingdom and operates in compliance with applicable financial and data protection regulations.

Our mission is to provide access to ethical and halal compliant investment solutions in the Middle Eastern markets and globally.

SCapital adopts the same high standards of data protection and accountability described in this policy in all its operations.

3. Types of Data Collected

We collect the following categories of data:

• Personally Identifiable Information (PII);
• Technical usage data (device, IP address, browser, activity);
• Financial information;
• Biometric data (where required for KYC purposes);
• Data obtained from third-party platforms and referral sources.

All data is processed in compliance with the principles of data minimization, security, and confidentiality, with protection measures consistent with those described in this policy.

4. Purpose of the Processing

The data collected is used to:

• Provide access to platform features;
• Verify your identity and comply with legal obligations;
• Offer personalized content and services;
• Detect and prevent fraud, abuse, or unauthorized activity;
• Send notifications, updates, and offers.

Processing always takes place in compliance with applicable regulations and the security measures adopted by SCapital.

5. Legal Basis of Processing

We process personal data based on the following conditions:

• Contractual necessity (e.g. registration and use of the platform);
• Legal obligations (e.g. financial reporting);
• Legitimate interest (e.g. development and improvement of services);
• User consent (e.g. marketing communications).

6. Data Retention and Security

Personal data is stored securely using encryption systems, access controls, and appropriate organizational measures.

Data is retained only for the period necessary to achieve the purposes for which it was collected or as required by law.

7. User rights under the GDPR

The user has the right to:

• Access your personal data;
• Request rectification or deletion of data;
• Limit or object to processing;
• Request data portability;
• Revoke consent at any time;
• Lodge a complaint with a competent supervisory authority.

8. Sharing Data with Third Parties

Data may be shared with:

• Law enforcement authorities and regulatory bodies;
• Financial institutions and service providers;
• Fraud analysis and prevention services.

In such cases, only the minimum amount of information necessary is shared.

9. International Data Transfers

Personal data may be transferred outside the European Economic Area only if adequate safeguards are in place, including standard contractual clauses and adequacy decisions.

10. Cookie Policy

Cookies are used to ensure the proper functioning of the platform and improve the user experience.

We use:

• Essential cookies (authentication, security);
• Analytical cookies (usage statistics);
• Third-party cookies (e.g. Google Analytics).

The user can disable cookies through their browser settings, which may limit some of the site's features.

11. Exercise of Rights

To exercise your data protection rights, you can submit a formal request. SCapital will respond within 30 days, as required by the GDPR.

The request must include proof of the user's identity.

12. Policy Updates

This policy may be updated periodically. Significant changes will be communicated via the platform and will become effective upon publication.