1. Scope and purpose

Ohana Capital AG, making the commissioned Ohana Capital institutional product preview available, uses personal information to administer invited access, secure accounts, demonstrate verification and platform workflows, communicate with users, and meet applicable legal obligations.

This policy applies to information processed through the website, authenticated preview, customer support, recruitment and careers workflows, identity-verification demonstrations, simulated financial records, portfolio tools, and product-model workflows.

2. Information we collect

2.1 Information you provide

Depending on the services requested, this may include:

• Name, date of birth, contact information, country, and residential address
• Government-issued identity documents and verification images
• Tax, employment, income, source-of-funds, and suitability information
• Information entered into modeled financial workflows; real payment credentials and external wallet addresses must not be submitted
• Account preferences, support requests, and communications
• Information submitted when enabling account-security features
• Recruitment information such as a résumé, cover note, employment history, professional profile link, and application communications

2.2 Account and transaction information

We process records created through use of the platform, including:

• Simulated orders, positions, trades, balances, portfolio values, and transaction history
• Modeled request, transfer, withdrawal, reward, and maturity records
• Verification status, legal acceptance records, and security events
• Product selections, account tier information, and support history

2.3 Device and usage information

When the platform is accessed, technical information may be collected, including:

• IP address, browser, operating system, device, and language
• Access dates, pages viewed, navigation, and feature interactions
• Session, authentication, security, reliability, and error information
• Cookie and analytics preferences

3. How information is collected

Information is collected directly from you, generated through platform activity, received from financial and identity-verification service providers, or obtained where permitted from fraud-prevention, sanctions, and public-record sources.

We do not intentionally collect information that is not reasonably connected to an account, requested service, security need, or applicable obligation.

4. How information is used

Information may be used to:

• Create, administer, authenticate, and protect accounts
• Verify identity and conduct risk-based KYC, sanctions, and financial-crime checks
• Process orders, funding requests, withdrawals, and product instructions
• Calculate balances, portfolio history, rewards, and maturity information
• Provide support and deliver service, security, and legal notifications
• Detect suspicious, unauthorized, abusive, or fraudulent activity
• Maintain records and respond to valid legal or regulatory requests
• Diagnose reliability issues and improve products where permitted
• Obtain and record required policy and cookie choices
• Evaluate job applications, communicate with candidates, document hiring decisions, and administer recruitment

We do not sell personal information to third parties for their own marketing.

5. Sharing and service providers

Information may be shared only where reasonably necessary with:

• Identity-verification, fraud-prevention, sanctions-screening, and security providers
• Banks, payment providers, market-data providers, and transaction counterparties
• Hosting, communications, analytics, support, and professional service providers
• Recruitment, document-storage, and hiring-administration providers
• Courts, authorities, law enforcement, or regulators where disclosure is legally required
• Parties involved in a corporate transaction, subject to appropriate safeguards

Service providers receive information for defined purposes and are expected to handle it under contractual and legal requirements applicable to their role.

6. Cookies and analytics

Necessary browser storage is used to maintain sessions, remember security state, and preserve essential preferences. Optional analytics is activated only after the corresponding choice is made through the cookie-preferences banner.

Cookie choices are versioned and may be changed by clearing stored preferences and selecting again when the banner is presented. Marketing storage is not enabled by the current preference flow.

7. International processing

Providers and infrastructure may process information outside the country where a user resides. Where applicable law requires safeguards for an international transfer, we use an appropriate contractual, organizational, or legal transfer mechanism.

8. Security

We use technical and organizational controls appropriate to the information and service, which may include:

• Encryption in transit and protected storage controls
• Role-based access restrictions and authenticated administrative access
• Account, financial-action, and security-event records
• Monitoring and controls intended to detect unauthorized activity
• Optional multi-factor authentication available through account settings
• Incident handling, backup, and service-recovery procedures

No internet service or storage method can guarantee absolute security. Users should use unique credentials, protect authentication devices, and promptly report suspected unauthorized access.

9. Retention

Information is retained for as long as reasonably necessary to provide services, secure accounts, resolve disputes, maintain financial and legal records, and meet applicable retention obligations. Retention periods vary by information type, account status, product, and jurisdiction.

Website job applications are scheduled for review or deletion after 365 days unless a shorter period is requested and permitted, a longer period is required by law, or the candidate separately agrees to consideration for future roles.

When information is no longer required, it is deleted, anonymized, or isolated from active use in accordance with applicable requirements and operational constraints.

10. Rights and choices

Depending on applicable law and subject to permitted limitations, a user may be able to:

• Request access to or a copy of personal information
• Correct inaccurate or incomplete information
• Request deletion or restriction of certain processing
• Object to or withdraw consent from consent-based processing
• Request portable data in an available structured format
• Opt out of non-essential analytics and marketing communications
• Submit a complaint to an applicable data-protection authority

Identity verification may be required before a request is fulfilled. Financial, security, fraud-prevention, and legal records may need to be retained even after an account is closed or a deletion request is made.

11. Minors

The platform is not intended for anyone under 18 or below the legal age required to use the services in their jurisdiction. We do not knowingly offer accounts to children.

12. Policy changes

This policy may be updated to reflect product, legal, provider, or security changes. Material revisions are versioned and presented through the platform when renewed acceptance is required.