1. DATA CONTROLLER

The data controller responsible for your personal data is:

KiiBase Ltd
Company Number: 16693982
Registered Office: 1st Floor North Westgate House, Harlow, Essex, London, CM20 1YS, United Kingdom
For data protection enquiries, contact: legal@kiibase.net

2. PERSONAL DATA WE COLLECT

We may collect and process the following categories of personal data:

2.1 Identity Data

• Full name
• Date of birth
• Government-issued identification documents
• Photograph or selfie verification

2.2 Contact Data

• Residential address
• Email address
• Telephone number

2.3 Financial Data

• Bank account details
• Payment transaction records
• Subscription amounts

2.4 Compliance Data

• Know Your Customer (KYC) documentation
• Anti-money laundering checks
• Screening results

2.5 Technical Data

• IP address
• Login activity
• Device and browser information

3. PURPOSES OF PROCESSING

We process personal data for the following lawful purposes:

• To register and administer user accounts.
• To process share subscription requests.
• To conduct identity verification and compliance checks.
• To maintain the Company’s register of members and share ledger.
• To communicate confirmations, notices, and dividend declarations.
• To comply with legal and regulatory obligations.

4. LAWFUL BASIS FOR PROCESSING

We rely on the following lawful bases under UK GDPR:

• Performance of a contract — where processing is necessary to administer a share subscription.
• Legal obligation — where processing is required to comply with company law, anti-money laundering obligations, or regulatory requirements.
• Legitimate interests — where processing is necessary to operate and secure the Portal and protect against fraud.

5. DATA SHARING

We may share personal data with:

• Professional advisers (legal, accounting, compliance) under confidentiality obligations.
• Payment service providers.
• Regulatory authorities where required by law.

We do not sell personal data.

6. INTERNATIONAL TRANSFERS

Where personal data is transferred outside the United Kingdom, appropriate safeguards will be implemented in accordance with UK GDPR.

7. DATA RETENTION

Personal data will be retained for as long as necessary to:

• Maintain the Company’s statutory registers.
• Comply with legal and regulatory obligations.
• Defend legal claims.

Identity verification records may be retained for the period required by applicable anti-money laundering laws.

8. DATA SECURITY

We implement appropriate technical and organisational measures to protect personal data, including:

• Access controls and role-based permissions
• Encryption of sensitive data where appropriate
• Secure storage of identification documents
• Audit logging of administrative actions

9. YOUR RIGHTS

Under UK GDPR, you have the right to:

• Request access to your personal data.
• Request correction of inaccurate data.
• Request erasure where legally permissible.
• Request restriction of processing.
• Object to processing based on legitimate interests.

Requests may be submitted to the contact details in Section 1.

10. COMPLAINTS

If you are dissatisfied with our handling of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) in the United Kingdom.

11. CHANGES TO THIS POLICY

We may amend this Policy from time to time to reflect changes in law or operational practices. Updated versions will be made available within the Portal.