Privacy Notice

1. Who we are

MT Capital Markets Ltd, trading as RockLake Capital, is the data controller for personal data collected through the RockLake Platform. We are based in the Cayman Islands and process personal data in line with the Cayman Islands Data Protection Act (as amended) and other laws that apply to us.

In this notice, “personal data” means information about an identifiable individual. For anything in it, contact ir@rocklakecapital.com.

2. What we collect

• Identity and contact details: name, date of birth, nationality, country of tax residence, address, email and phone number.
• Invitation details: the invitation code you used to open your account.
• Verification material: the photo ID and proof of address you upload, and any tax identification number you choose to provide.
• Financial and suitability information: employment status, income and net worth ranges, source of funds, investment experience, risk tolerance and investor classification.
• Declarations: your self-certification of investor status, your confirmations about politically exposed person and US Person status, and the Platform Participation Agreement you sign, including your typed name and the time you signed.
• Account information: holdings, transactions, payments and their references, agreements, documents and statements linked to your account.
• Things you send us: messages, requests and questions about products, change-of-circumstances reports, bereavement reports, and complaints.
• Technical information: sign-in and session data needed to keep your account secure, your IP address, and basic browser and device details.
• Screening results: the outcome of checking your details against sanctions, politically-exposed-person and similar lists and other public sources.

Most of this comes from you. Some comes from the documents you provide, from screening and verification checks, from public sources, from your representative if you have one, and from our own records of how the account is used.

3. Why we use it

We use personal data to:

• assess your application, verify your identity and confirm your eligibility (to take steps at your request before entering an agreement with you, and to meet our legal obligations);
• meet anti-money-laundering, counter-terrorist-financing, sanctions and tax reporting obligations, including ongoing monitoring (legal obligation);
• provide your account, payments, portfolio reporting and support, and make and administer your investments (to perform our agreement with you);
• share what is needed with the parties that issue, manage, hold or administer your investments (to perform our agreement with you, and our legitimate interests in operating the service);
• keep the Platform secure, prevent fraud and misuse, and maintain audit records (our legitimate interests and legal obligations);
• handle your questions, requests, complaints and bereavement or change-of-circumstances reports (to perform our agreement, our legitimate interests and legal obligations);
• send you service messages such as statements, security alerts and notices of changes to your account or our terms (to perform our agreement and to meet legal obligations); and
• establish, exercise or defend legal claims, and respond to regulators and courts (our legitimate interests and legal obligations).

We do not sell your personal data, and we do not use it for advertising. We do not send you marketing communications unless you have asked us to. We do not make decisions about you based solely on automated processing: every application is reviewed by a member of our compliance team.

4. Sensitive information

Identity documents can reveal sensitive details, such as nationality and appearance, and screening can reveal information about alleged offences, sanctions or adverse media. We process this only as needed to verify identity and to meet our legal obligations, and we limit access to authorised compliance staff.

5. Who we share it with

We share personal data only where needed, with:

• service providers that help us run the Platform, such as cloud hosting, database, file storage, email delivery and security providers, who process data on our instructions;
• the issuers, managers, administrators, custodians, banks and other parties that need your details to accept, hold or service an investment made for you, who may use them under their own legal duties;
• identity-verification and screening providers, where we use them;
• regulators, tax and financial-intelligence authorities, law enforcement and courts where we are legally required or permitted to, including the Cayman Islands Monetary Authority (CIMA), the Cayman Islands Tax Information Authority and the Financial Reporting Authority, and authorities in other countries under information-exchange arrangements;
• professional advisers, auditors and insurers, under confidentiality;
• people you have authorised to act for you, once we have verified their authority; and
• a successor business, if we are ever sold or restructured, subject to equivalent protections.

We require our service providers to protect personal data and to use it only for the purposes we set.

6. Third parties that receive data from your browser

One third-party resource is loaded directly by your browser, which means the provider receives your IP address and basic technical details when it loads. Our typefaces are served from our own site, so no font provider receives your address:

• Notice (notice.co), which supplies the market chart shown on the holding page of certain investments, such as IPO allocations. The chart is shown in an embedded frame loaded from Notice. Notice also receives the address of our website. We do not send it your name, your account details or the address of the specific page you are viewing.

We do not control what this provider does with that data. See its own privacy information, and our Cookie Policy.

7. International transfers

Our service providers operate in several countries, and some personal data is stored or processed outside the Cayman Islands. When we transfer personal data internationally we take steps to make sure it stays adequately protected, for example by choosing reputable providers, by using contractual safeguards, and by limiting what is shared. Authorities in other countries may also receive information where the law requires it. On request we can tell you more about the safeguards that apply.

8. How long we keep it

• Account and compliance records are kept for as long as your account is open and afterwards for the period the law requires. Anti-money-laundering records are generally kept for at least five years after the relationship ends, and longer where another law or a legal claim requires.
• Application data for declined applicants is kept only as long as we need it to meet legal obligations and handle any dispute.
• Messages, complaints and similar records are kept for as long as needed to deal with them and for any period the law requires afterwards.
• Security and audit logs are kept for as long as needed to keep the Platform secure and to keep a reliable record of administrative actions.

When we no longer need data, we delete it or make it anonymous.

9. How we protect it

Data is encrypted in transit. Identity documents are held in private storage, are not publicly accessible, and can be opened only by you and authorised compliance staff through short-lived links. Passwords are stored only in hashed form by our authentication provider. Access is restricted by role, and administrative actions are recorded in an audit log. No system is perfectly secure, and we cannot guarantee absolute security.

If there is a personal data breach, we will notify you and the Cayman Islands Ombudsman within the time the law requires.

10. Your rights

Subject to the law, you may ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct inaccurate or incomplete data;
• delete, block or destroy data where we have no legal reason to keep it;
• stop or restrict certain processing, including processing based on our legitimate interests, in some circumstances; and
• stop using your data for direct marketing.

To exercise a right, email ir@rocklakecapital.com. We may need to verify your identity first, and we aim to respond within 30 days. Some rights are limited where we must keep data by law, where the data relates to other people, or where the law prevents us from telling you about a report we have made to the authorities.

If you are unhappy with how we handle your data, please tell us first. You may also complain to the Cayman Islands Ombudsman, which supervises data protection in the Cayman Islands.

11. Other people's information

If you give us information about another person, for example a representative, or a relative in a bereavement report, you must be entitled to do so and, where appropriate, tell them. We handle that information only for the purpose for which it was given.

12. If you live outside the Cayman Islands

Depending on where you live, the law there may give you additional rights over your personal data. Contact us if you would like to use them and we will consider your request under the law that applies.

13. Children

The Platform is for adults only. We do not knowingly collect personal data from anyone under 18, and we decline applications from minors.

14. Changes

We may update this notice. The date at the top shows when it was last changed, and we will flag material changes through the Platform.

15. Contact us

MT Capital Markets Ltd, trading as RockLake Capital, Artemis House, 67 Fort Street, George Town, Grand Cayman KY1-1111, Cayman Islands. Email: ir@rocklakecapital.com.