Victory Technologies Ltd trading as VictoryMarkets

Effective Date: SEPTEMBER 2026

1. Introduction

Victory Technologies Ltd, trading as VictoryMarkets (“VictoryMarkets”, “Victory”, “we”, “us” or “our”), respects the privacy of its clients, prospective clients, representatives, website users and other persons whose personal information we process.

Victory Technologies Ltd is incorporated in Mauritius under company number 230287, with its registered office at C/o DTOS Ltd, 10th Floor, Standard Chartered Tower, 19 Cybercity, Ebene 72201, Mauritius.

Victory Technologies Ltd is licensed and regulated by the Financial Services Commission of Mauritius (“FSC”) as an Investment Dealer (Full Service Dealer, excluding Underwriting) under licence number GB25204886.

This Privacy Policy explains how we collect, use, store, disclose and otherwise process personal data in connection with:

• the VictoryMarkets website and digital platforms;
• applications to become a client;
• client onboarding and verification;
• discretionary investment and portfolio management services;
• trading, execution and account administration;
• communications with us;
• regulatory and compliance obligations; and
• our general business activities.

For the purposes of applicable data protection law, Victory Technologies Ltd will ordinarily act as the data controller in respect of personal data described in this Privacy Policy.

2. Applicable Data Protection Law

We process personal data in accordance with applicable data protection and privacy legislation, including, where applicable:

• the Mauritius Data Protection Act 2017 and regulations made under it;
• applicable requirements and guidance of the Mauritius Data Protection Office;
• the EU General Data Protection Regulation (EU) 2016/679 (“GDPR”), where the GDPR applies to our processing activities; and
• other applicable privacy and data protection requirements in jurisdictions in which we provide services.

Where different requirements apply, we will seek to comply with the standard applicable to the relevant processing and data subject.

3. Personal Data We May Collect

Depending on your relationship with VictoryMarkets, we may collect and process information including:

3.1 Identification information

This may include:

• full name;
• date and place of birth;
• nationality and citizenship;
• gender, where relevant;
• passport details;
• national identity document details;
• driver’s licence details;
• photograph or facial image;
• signature;
• residential, registered and correspondence addresses; and
• tax identification numbers.

3.2 Contact information

This may include:

• email addresses;
• telephone numbers;
• residential or business addresses; and
• preferred communication methods.

3.3 Client due diligence and regulatory information

To comply with our regulatory obligations, we may process information relating to:

• identity verification;
• beneficial ownership;
• directors, shareholders, trustees, partners or authorised representatives;
• source of funds;
• source of wealth;
• occupation and employment;
• business activities;
• financial circumstances;
• tax residence;
• FATCA and CRS classifications;
• politically exposed person (“PEP”) status;
• sanctions screening;
• adverse media;
• fraud prevention;
• anti-money laundering and counter-terrorist financing checks; and
• documents and information supporting the above.

Where permitted or required by law, identity-verification procedures may include biometric or facial-matching technology.

3.4 Financial and investment information

This may include:

• bank account details;
• payment information;
• investment amounts;
• deposits and withdrawals;
• transaction history;
• portfolio information;
• trading account information;
• account balances;
• performance information;
• investment objectives;
• risk tolerance;
• investment knowledge and experience;
• sophisticated, professional or experienced investor classifications; and
• information necessary to assess whether a service or investment is appropriate or suitable.

3.5 Communications and records

We may retain:

• email correspondence;
• electronic messages;
• telephone or video communications where recorded or documented;
• instructions received from you;
• contractual documents;
• electronically signed documents;
• complaints;
• enquiries; and
• records of our dealings with you.

3.6 Website and technical information

When you access our website or digital services, we may collect:

• IP address;
• browser and device type;
• operating system;
• session information;
• log data;
• referring URLs;
• pages viewed;
• dates and times of access;
• cookie identifiers; and
• similar technical or analytical information.

Further information is contained in our Cookie Policy.

4. How We Collect Personal Data

We may obtain personal data:

• directly from you;
• through our website or client application;
• through account opening or onboarding forms;
• through electronic identity-verification and KYC providers;
• through electronic signature platforms;
• from your authorised representatives, advisers or introducers;
• from companies, trusts or other entities with which you are associated;
• from banks, brokers, custodians, liquidity providers and financial institutions;
• from credit, fraud-prevention, sanctions, PEP and adverse-media databases;
• from regulatory authorities, government bodies and law-enforcement agencies;
• from publicly available sources; and
• from other third parties where permitted by law.

If you provide us with personal information concerning another person, you should ensure that you are authorised to provide that information and that the person has been appropriately informed about its disclosure to us.

5. Why We Process Personal Data

We may process personal data for the following purposes.

5.1 Providing our services

Including to:

• assess and process applications;
• establish and administer client relationships;
• enter into and perform agreements with clients;
• manage discretionary investment accounts and portfolios;
• facilitate trading and execution;
• calculate performance, fees and account values;
• process subscriptions, deposits and withdrawals;
• provide statements and reporting; and
• communicate with clients.

5.2 Regulatory and legal compliance

Including to:

• undertake KYC and customer due diligence;
• verify identity and beneficial ownership;
• establish source of funds and source of wealth;
• conduct sanctions, PEP and adverse-media screening;
• comply with AML/CFT requirements;
• satisfy FSC requirements;
• comply with tax-reporting obligations including FATCA and CRS;
• maintain books and records;
• respond to regulators, courts or competent authorities; and
• investigate or report suspected unlawful activity.

5.3 Risk management and protection of our business

Including to:

• prevent and detect fraud;
• manage operational, financial and compliance risks;
• protect our systems and information;
• investigate misuse or security incidents;
• establish, exercise or defend legal claims; and
• protect our legal and commercial interests.

5.4 Administration and improvement

Including to:

• operate and improve our systems, applications and website;
• maintain records;
• analyse service performance;
• undertake internal audits;
• manage suppliers and service providers; and
• improve our products and client experience.

5.5 Communications and marketing

Where permitted by law, we may send existing or prospective clients information concerning VictoryMarkets, investment research, market commentary, services, events or other relevant information.

Where consent is required, we will obtain consent before sending such communications. You may unsubscribe or object to direct marketing at any time.

6. Legal Bases for Processing

Depending on the circumstances, we process personal data on one or more of the following grounds:

Contract

Processing is necessary to enter into or perform a contract with you, including a discretionary investment services agreement.

Legal or regulatory obligation

Processing is necessary to comply with laws, regulatory requirements, AML/CFT obligations, tax requirements, FSC requirements or lawful requests from competent authorities.

Legitimate interests

Processing is necessary for our legitimate business interests or those of a third party, provided those interests do not override your fundamental rights and freedoms.

These interests may include:

• operating a secure and effective investment business;
• preventing fraud and financial crime;
• managing risk;
• maintaining and improving services;
• protecting our legal rights; and
• managing client and commercial relationships.

Consent

Where required, we may rely upon your consent, including for particular marketing activities, optional cookies or certain categories of personal data.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing lawfully undertaken before withdrawal.

Other lawful grounds

We may process information where necessary to establish, exercise or defend legal claims, protect vital interests or where another applicable legal basis permits or requires processing.

7. Special Categories and Biometric Information

Certain information processed as part of identity verification, regulatory screening or compliance processes may constitute sensitive or special-category personal data under applicable law.

Where biometric technology, including facial verification or facial matching, is used, such processing will be undertaken only where a lawful basis exists and appropriate safeguards are implemented.

Where applicable law requires explicit consent for such processing, that consent will be obtained separately.

8. Automated Screening and Decision-Making

We may use automated systems as part of:

• identity verification;
• sanctions screening;
• PEP screening;
• fraud detection;
• AML/CFT monitoring;
• risk assessment; and
• client onboarding.

Automated systems may generate risk indicators, matches or alerts.

Where a decision would have a legal or similarly significant effect on an individual and applicable law gives that individual rights in relation to automated decision-making, we will provide the safeguards required by law, which may include human review of the decision.

9. Disclosure of Personal Data

We may disclose personal data where reasonably necessary to:

• our directors, officers, employees and authorised representatives;
• our management company, company secretary and corporate administrators;
• identity-verification and KYC providers;
• electronic-signature providers;
• banks and payment-service providers;
• brokers, custodians, prime brokers, liquidity providers and execution counterparties;
• trading and technology infrastructure providers;
• IT, hosting, cybersecurity, communications and cloud-service providers;
• CRM and client-management providers;
• professional advisers including lawyers, accountants and auditors;
• insurers;
• tax advisers and tax authorities;
• the FSC;
• the Mauritius Financial Intelligence Unit;
• the Mauritius Data Protection Office;
• law-enforcement bodies;
• courts and other competent authorities;
• prospective purchasers, investors or counterparties in connection with a bona fide corporate transaction; and
• other parties where disclosure is permitted or required by law.

Our principal onboarding infrastructure may include third-party service providers such as Sumsub for identity verification and KYC processes and DocuSign for electronic execution of documents.

Those providers may process information in accordance with their own applicable privacy notices as well as under contractual arrangements with us.

We do not sell personal information to third parties.

10. International Transfers

VictoryMarkets operates internationally, and some of our service providers, financial counterparties or technology providers may process personal information outside Mauritius or outside the country in which you reside.

Where personal data is transferred internationally, we will take appropriate steps required by applicable law to protect that data.

Depending upon the circumstances, safeguards may include:

• contractual protections;
• standard contractual clauses or equivalent transfer mechanisms;
• transfers to jurisdictions recognised as providing adequate protection;
• appropriate technical and organisational safeguards;
• transfers necessary for performance of a contract;
• transfers required for legal or regulatory purposes; or
• explicit consent where permitted and appropriate.

11. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access;
• unlawful processing;
• accidental loss;
• alteration;
• disclosure;
• destruction; and
• misuse.

Measures may include access controls, authentication measures, encryption, information-security policies, contractual confidentiality requirements, system monitoring and security controls appropriate to the nature and sensitivity of the information concerned.

No information system can, however, be guaranteed to be completely secure.

12. Retention of Personal Data

We retain personal information only for as long as necessary for the purposes for which it was collected and to satisfy applicable legal, regulatory, accounting and reporting obligations.

Because Victory Technologies Ltd is a regulated financial-services business, certain client and transaction records are generally required to be retained for at least seven years, including relevant customer due diligence, transaction and business records.

Accordingly, personal data relating to a client may ordinarily be retained for at least seven years following termination of the client relationship or completion of the relevant transaction, and for longer where:

• required by applicable law or regulation;
• requested by a competent regulatory or governmental authority;
• reasonably necessary in connection with litigation, complaints or investigations; or
• required for the establishment, exercise or defence of legal claims.

Information which no longer needs to be retained will be securely deleted, destroyed or anonymised where reasonably practicable.

13. Your Rights

Subject to applicable law and any lawful limitations or exemptions, you may have the right to:

• be informed about the processing of your personal data;
• obtain confirmation as to whether we process your personal data;
• request access to your personal data;
• obtain a copy of personal data held about you;
• correct inaccurate or incomplete information;
• request erasure of information in certain circumstances;
• request restriction of processing;
• object to certain processing;
• object to direct marketing;
• request data portability where applicable;
• withdraw consent where processing is based upon consent;
• exercise rights relating to certain automated decisions; and
• lodge a complaint with an applicable supervisory authority.

These rights are not absolute. For example, regulatory and AML/CFT record-retention requirements may prevent us from deleting information even where you request its deletion.

14. Exercising Your Rights

Requests concerning your personal information may be submitted to:

Victory Technologies Ltd
C/o DTOS Ltd
10th Floor, Standard Chartered Tower
19 Cybercity
Ebene 72201
Mauritius

Email: legal@victory-markets.com

We may require reasonable information to verify your identity before acting on a request.

We will respond within the period required by applicable law.

15. Complaints

If you have concerns about our use of your personal data, please contact us first at:

legal@victory-markets.com

You may also have the right to lodge a complaint with the:

Data Protection Office of Mauritius

or, where the GDPR applies, with the competent data protection supervisory authority in the relevant EU or EEA jurisdiction.

16. Direct Marketing

You may request that we stop using your personal information for direct marketing at any time.

Marketing emails will ordinarily contain an unsubscribe mechanism. You may also contact legal@victory-markets.com.

An objection to marketing will not prevent us from sending communications that are necessary to administer your account, perform our contractual obligations or satisfy legal or regulatory requirements.

17. Cookies and Similar Technologies

Our website and electronic services may use cookies and similar technologies.

Non-essential cookies, including certain analytics, advertising or tracking technologies, will only be activated where the consent required by applicable law has been obtained.

Further details are contained in our Cookie Policy.

18. Third-Party Websites

Our website may contain links to third-party websites or services.

We are not responsible for the privacy practices of third-party websites which are not controlled by Victory Technologies Ltd. You should review the applicable privacy information provided by those third parties.

19. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time to reflect changes to:

• our services;
• technology;
• processing activities;
• service providers;
• regulatory requirements; or
• applicable law.

The current version will be published on the VictoryMarkets website together with its effective or last-updated date.

Material changes may additionally be communicated to clients where required or appropriate.

20. Contact

Questions concerning this Privacy Policy or our processing of personal information should be directed to:

Victory Technologies Ltd trading as VictoryMarkets
C/o DTOS Ltd
10th Floor, Standard Chartered Tower
19 Cybercity
Ebene 72201
Mauritius

Email: legal@victory-markets.com
Website: www.victory-markets.com