Privacy and Data Protection Policy v1.0

This is the single privacy notice for MySerrari Invest, MySerrari Wealth Builder and serrarigroup.com.

1. Who we are

Serrari Group Limited ("Serrari", "we", "us") is the data controller for the personal data described in this policy.

This policy is written to meet our obligations under the Data Protection Act, 2019 ("the Act") and the regulations made under it. Where we process personal data on behalf of another controller — for example a fund manager whose investor accounts we administer — that controller's own notice also applies, and we will tell you when this is the case.

2. What this policy covers

This policy applies to:

• MySerrari Invest — our investment platform
• MySerrari Wealth Builder — our financial planning and coaching product
• serrarigroup.com — our website, including its calculators, guides and marketplace

Product-specific detail is in the annexes at the end. Where an annex differs with this main policy, the annex applies for that product.

3. The personal data we collect

You give us:

• Identity — full name, date of birth, national ID or passport number and type, KRA PIN, a photograph of your identity document, residential and postal address
• Contact — phone number, email address
• Financial — investment instructions, deposit and withdrawal records, payment references, bank or mobile money details, holdings and transaction history
• Financial planning inputs — income, expenditure, assets, liabilities, goals and any figures you enter into our planners and calculators
• Account — login credentials, PIN, authentication factors, communication preferences
• Support — the content of your enquiries and our correspondence with you

We collect automatically: IP address, device and browser identifiers, the pages and features you use, timestamps, and diagnostic and audit logs of actions taken in your account.

We receive from others: payment confirmations and settlement data from payment providers; account, unit and valuation data from fund managers and their custodians; identity verification results from our verification providers.

Sensitive personal data

Your identity document, and any facial image or biometric template used to verify it, are sensitive personal data under the Act. We process these only to meet our legal obligation to verify your identity, and only with the additional protections described in section 12.

We do not process data revealing your health, ethnicity, religion, political opinions or sexual orientation, and we ask you not to send it to us.

4. Why we process your data, and our lawful basis

In accordance with section 30 of the Act, we process personal data only where a lawful basis applies.

Where we rely on legitimate interests, we have assessed that our interest does not override your rights and freedoms, and we will provide that assessment on request.

Providing some data is a legal requirement rather than a choice: if you do not provide the identity information we are required to collect, we cannot open an account or accept your money.

5. Who we share your data with

We do not sell your personal data, and we do not share it for anyone else's independent marketing.

Every processor acting on our behalf is bound by a written agreement requiring it to process your data only on our instructions and to protect it to the standard the Act requires. We keep an up-to-date register of these processors and will tell you who they are on request.

6. Where your data is processed

Your personal data is processed outside Kenya:

• Our application servers and databases run in Amazon Web Services' Ireland region
• Google Firebase Authentication processes your email address and phone number in the United States and other Google locations
• Cloudflare serve our web applications from global edge locations, processing IP addresses and request data

In accordance with section 48 of the Act, we transfer personal data outside Kenya only where the transfer is necessary to perform our contract with you and where appropriate safeguards are in place — written data processing agreements incorporating standard contractual protections, together with the security measures in section 12. Where sensitive personal data would be transferred outside Kenya, we do so only on a basis the Act permits and, where required, with your explicit consent. You may ask us for details of the safeguards applying to any transfer.

7. How long we keep your data

In accordance with section 39 of the Act, we keep personal data no longer than necessary.

When you close your account we remove your data from our active systems within 30 days, and from our backups within a further 90 days, except for records we are required to keep. Those we isolate, retain for the periods above, and use for no other purpose. We will tell you what has been retained and why.

Data held on your own device, including anything stored in your browser, is under your control and is cleared by clearing your browser data.

8. Your rights

Under Part IV of the Act you have the right to:

• Be informed of how we use your personal data — this policy
• Access the personal data we hold about you, and be told how we process it
• Correct inaccurate or incomplete data
• Delete data we no longer have a lawful reason to keep
• Object to processing, including processing based on our legitimate interests
• Restrict processing while a dispute about accuracy or lawfulness is resolved
• Data portability — receive your data in a structured, commonly used, machine-readable format
• Withdraw consent at any time where consent is our basis
• Not be subject to a decision based solely on automated processing — see section 10

To exercise any right, contact our Data Protection Officer. We will acknowledge your request within 7 days of receiving it and complete it within 30 days, telling you if we need longer and why. We may ask you to verify your identity first — we will not disclose your data to someone who cannot prove they are you.

Exercising these rights is free. Where a request is manifestly excessive or repetitive we may charge a reasonable fee or decline it, explaining why.

Some rights are limited where we must keep data by law. We cannot, for example, delete a transaction record inside its statutory retention period — but we will restrict its use to that legal purpose alone.

9. Consent, and withdrawing it

Where we rely on consent, we ask for it separately from our terms, in plain language, with no pre-ticked boxes, and we record when and how you gave it.

You can withdraw consent at any time — in the app's notification settings, through the unsubscribe link in any marketing message, or by contacting our Data Protection Officer. Withdrawal takes effect promptly and does not affect processing that already happened lawfully.

Withdrawing marketing consent does not stop transactional messages — confirmations, one-time codes, statements and notices about your money. Those are part of the service and we send them on the basis of our contract with you, not consent.

10. Automated decisions and profiling

We use automated processing to screen payments and behaviour for fraud and money laundering, and to generate the scores, projections and recommendations in our planning tools.

Our planning outputs are information, not decisions — they do not by themselves grant or refuse you anything. Where an automated check does affect you, for example by holding a payment for review, a person reviews the outcome before it becomes final.

In accordance with section 35 of the Act, you may ask us to explain such a decision, ask for human review, and contest the result. Contact our Data Protection Officer.

11. Children

Our services are for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us personal data, tell our Data Protection Officer and we will delete it.

12. How we protect your data

We maintain technical and organisational measures appropriate to the risk, including:

• Encryption in transit — TLS on every connection to our services
• Encryption at rest for databases and backups holding personal data
• Segregation — customer personal data held separately from data processed for any other party
• Backups and recovery — regular backups with restoration tested periodically
• Access control — role-based permissions, least privilege, deny-by-default on administrative systems, multi-factor authentication for staff, automatic session expiry, and account lockout after failed attempts
• Secrets management — credentials held in a managed secrets service, never in source code
• Audit trails — a durable record of who accessed a customer record and where each decision came from, covering every action that moves money
• Monitoring and alerting — automated alerts to named staff for security and payment anomalies
• Governed change — approval from a second person required for sensitive operational actions
• Staff obligations — confidentiality undertakings and data protection training
• Written policies — an information security policy, an incident response plan and a business continuity plan, reviewed at least annually

No system is completely secure. Please keep your PIN and one-time codes to yourself; we will never ask you for them.

13. If there is a data breach

In accordance with section 43 of the Act, if a personal data breach is likely to result in a risk to your rights and freedoms we will:

1. Notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it
2. Notify you without undue delay, describing what happened, what data was involved, the likely consequences, and what we are doing about it
3. Record the breach, our assessment and our response in our breach register
4. Cooperate fully with any investigation by the Commissioner

14. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, secure our services, and understand how our products are used.

Strictly necessary cookies are required for the service to work and are set without consent. Google Analytics 4 is always on for usage measurement and service improvement. Optional advertising cookies are set only with your consent, which we ask for when you first visit and which you can change at any time through the cookie settings link in our website footer. Withdrawing consent stops further collection; it does not delete data already gathered, which expires as set out in section 7.

We may also ask a few optional profile questions (age range, location, investor type and goal, and, only with a separate explicit consent, gender, which is sensitive personal data). Answers are held as anonymous attributes in Google Analytics and can be deleted through the same cookie settings link. See section 5A of our Cookie Policy.

15. Complaints

Please raise any concern with our Data Protection Officer first — we would rather fix it. We will acknowledge your complaint within 7 days and respond substantively within 30 days.

You also have the right under section 56 of the Act to lodge a complaint directly with the regulator, whether or not you have come to us first:

Office of the Data Protection Commissioner
Britam Tower, Hospital Road, Upper Hill, Nairobi.
info@odpc.go.ke · www.odpc.go.ke

16. Changes to this policy

We review this policy at least annually, and whenever our processing changes materially. The version number and effective date at the top of this document change with every revision, and we keep previous versions so that we can tell you which policy applied on any given date.

Where a change materially affects your rights we will notify you directly, through the app or by email, before it takes effect. We will not apply a new purpose to data already collected without a lawful basis for doing so.

Annex A — MySerrari Invest

Additional data: your investor account reference with each fund manager, unit holdings, valuations, payment references, and the source account of every payment you make.

Additional recipients: the fund manager of each fund you invest in, and that manager's custodian. Your units are registered in your own name on the manager's register, which means:

• Your identity details are disclosed to that manager, which is separately responsible as a controller for the account it holds in your name and applies its own privacy notice to it
• The manager's compliance team decides whether to accept you as an investor. We pass on its decision and cannot overturn it
• Your payment goes directly to the fund's collection account at its custodian. Your payment reference is what connects your money to your account — if it is wrong or missing, the manager may hold your money unallocated until it can be identified

Withdrawals are paid to the account you registered. We do not pay third parties, and changing your payout destination requires re-verification.

Additional retention: instruction and allotment records are kept for 7 years, including for orders that were rejected or refunded.

Annex B — MySerrari Wealth Builder

Additional data: the financial position you enter — income, expenditure, assets, liabilities, dependants and goals — together with the scores, plans and projections we generate from it.

How we use it: to produce your plan and track your progress. These outputs are guidance, not regulated investment advice, and are not an automated decision under section 10.

Retention: planning inputs not linked to any transaction are deleted within 30 days of account closure. You can clear individual planners at any time from within the app.

Annex C — serrarigroup.com

Additional data: pages viewed, referral source, approximate location derived from your IP address, and anything you enter into our public calculators.

Calculator inputs are processed to return your result. Where a calculator runs entirely in your browser, the figures are never sent to us. Where a result is emailed to you, we process your email address on the basis of your request.

Newsletter and content subscriptions are consent-based, with an unsubscribe link in every message.

Cookies: see section 14. Google Analytics 4 is always on; our consent banner controls optional advertising technologies on this site.