Privacy Policy

Quantal Ltd ("Quantal", "we", "us", "our") is a financial technology company registered in England and Wales (Company No. 11284572) with its registered office at 12 Finsbury Square, London EC2A 1AS. We are the data controller for the personal data we collect through our Platform.

We collect the following categories of personal data: • Identity data: full name, date of birth, government-issued identification documents • Contact data: email address, phone number, postal address • Financial data: bank account details, transaction history, wallet addresses • Technical data: IP address, browser type, device identifiers, access timestamps • Usage data: pages visited, features used, investment and trading activity • KYC data: identity documents and verification results required by law

We use your personal data for the following purposes: • Providing and operating the Platform, including processing investments and transactions • Complying with our legal and regulatory obligations (including AML and KYC requirements) • Verifying your identity and preventing fraud • Communicating with you about your account and our services • Improving our products and personalising your experience • Marketing communications (only with your consent, which you may withdraw at any time)

We process your data on the following legal bases under GDPR: • Contract performance: processing necessary to provide services you have requested • Legal obligation: compliance with AML, KYC, and other financial regulations • Legitimate interests: fraud prevention, security, and service improvement • Consent: marketing communications and optional analytics

We share your personal data only as necessary: • Identity verification providers: to complete KYC checks • Payment processors: to facilitate deposits and withdrawals • Regulatory authorities: when required by law (e.g., FCA, HMRC) • Cloud infrastructure providers: who process data on our behalf under strict data processing agreements We do not sell your personal data to third parties for marketing purposes.

Your data may be transferred to and processed in countries outside the European Economic Area. When we transfer data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission or reliance on adequacy decisions.

We retain your personal data for as long as necessary to provide our services and comply with our legal obligations. Account data is retained for a minimum of 5 years after account closure in accordance with financial regulations. Transaction records are retained for 7 years. You may request deletion of data not subject to legal retention requirements.

Under GDPR and applicable data protection law, you have the following rights: • Right of access: to receive a copy of your personal data • Right to rectification: to correct inaccurate data • Right to erasure: to request deletion where no legal basis for retention exists • Right to restriction: to limit how we process your data • Right to data portability: to receive your data in a machine-readable format • Right to object: to direct marketing and legitimate interests processing To exercise any of these rights, contact privacy@quantal.io.

We implement industry-standard security measures including 256-bit AES encryption at rest, TLS 1.3 for data in transit, multi-factor authentication, regular penetration testing, and access controls limited to authorised personnel. However, no system is completely secure and we cannot guarantee absolute security.

We use cookies and similar tracking technologies on our Platform. For full details, please refer to our Cookie Policy. You can manage your cookie preferences at any time via our cookie consent banner or your browser settings.

For privacy enquiries or to exercise your rights, contact our Data Protection Officer at privacy@quantal.io. If you are dissatisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or your local supervisory authority.