Privacy Policy.

01About this policy

This Privacy Policy explains how Premium Capital Investment Ghana Limited ("we", "us", "our") handles personal information about clients, prospective clients, website visitors, job applicants, and other individuals whose data we process in connection with our investment business.

It is written for natural persons. Where a corporate client engages us, this policy still applies to the individuals associated with that client (directors, beneficial owners, authorised signatories, contact persons).

This policy applies to processing carried out by us as a data controller. Where we act as a data processor on behalf of another controller (for example, providing administration services to a third party fund), separate arrangements apply.

By using our website, applying to open an account, or engaging us as a client, you acknowledge that you have read this policy.

02Who we are

Premium Capital Investment Ghana Limited is the data controller responsible for the personal data described in this policy. Our registered office is at 8th Floor, One Airport Square, Airport City, Accra, Greater Accra Region, Ghana.

Our Data Protection Officer can be reached at compliance@premiumcapitalgh.com. Where required, we maintain registration with Ghana's Data Protection Commission.

03Personal data we collect

We collect different categories of personal data depending on your relationship with us. Some of it you give us directly. Some of it we generate as we provide services to you. Some of it we obtain from third parties such as identity verification services, regulators, and credit bureaus.

3.1 Data you give us directly

• Identity data: full name, date of birth, gender, nationality, country of birth, photograph.
• Identification documents: Ghana Card, international passport, driver's licence, voter ID, Tax Identification Number (TIN), SSNIT number.
• Contact data: residential address, postal address, email, mobile and landline numbers, Ghana Post GPS code.
• Employment and financial data: employer, job title, industry, income range, source of funds, source of wealth, bank account details for funding.
• Investment profile data: investment objectives, time horizon, risk tolerance, prior investment experience.
• Compliance data: politically-exposed-person (PEP) declarations, FATCA/CRS tax-residency declarations, sanctions screening responses, beneficial-ownership information.
• Family data: next of kin, marital status, beneficiaries (where you nominate them).
• Communications: emails, call recordings (where we tell you we are recording), messages submitted via our website forms.
• Marketing preferences: consent given or withheld for receiving research and promotional materials.
• Job application data: CV, cover letter, references, qualifications, prior employment history.

3.2 Data we generate

• Account data: client identification number, portfolio holdings, transaction history, valuations, performance reports.
• Risk-rating data: client risk score, suitability assessment outcomes, money-laundering risk rating.
• Internal records: meeting notes, advice records, internal correspondence about you.

3.3 Data we obtain from third parties

• Identity verification: National Identification Authority of Ghana (Ghana Card verification), passport verification services, electronic ID-verification providers.
• Sanctions and PEP screening: reputable commercial sanctions and politically-exposed-person screening databases.
• Credit reference agencies: licensed credit bureaux in Ghana, for institutional clients where appropriate.
• Bank of Ghana, SEC Ghana, Financial Intelligence Centre: regulatory data and any required disclosures.
• Partner banks: Ecobank Ghana, Stanbic Bank Ghana, GCB Bank — settlement and identification data where we share clients with them under written referral arrangements.
• Public sources: company registries, professional registers, news media (for adverse-media screening).

3.4 Technical data we collect automatically when you visit our website

• IP address, device type, operating system, browser type, language preference
• Pages visited, time spent on pages, navigation paths, referring URL
• Cookie identifiers (see section 10)
• Approximate geographic location derived from IP address

04How we use your data

We process personal data only for specified, explicit, and legitimate purposes. The main purposes are listed below.

4.1 Onboarding and KYC

To verify your identity, screen you against sanctions and PEP lists, and meet our obligations under the Anti-Money Laundering Act, 2020 (Act 1044) and SEC Ghana Conduct of Business rules before we can accept you as a client.

4.2 Providing investment services

To execute your instructions, manage your portfolio (where you have given us a discretionary mandate), provide investment advice, send statements and reports, and respond to your enquiries.

4.3 Suitability and risk profiling

To assess whether a particular investment or service is suitable for you given your goals, time horizon, risk tolerance, and financial circumstances.

4.4 Settlement and custody

To settle your transactions through our partner banks (Ecobank Ghana, Stanbic Bank Ghana, GCB Bank) and arrange custody of your securities.

4.5 Regulatory reporting

To make required reports to the Securities & Exchange Commission of Ghana, the Financial Intelligence Centre (under our suspicious-activity-reporting obligations), the Ghana Revenue Authority, and other regulators.

4.6 Risk management and fraud prevention

To monitor for suspicious transactions, detect potential market abuse, prevent fraud, and protect our firm and our clients.

4.7 Research and product development

To analyse aggregated, anonymised data about how clients use our services so we can improve them. We do not use your individual data to train automated decision-making models without telling you.

4.8 Marketing and client communications

To send you investment insights, market updates, and information about products and services that may interest you. You can opt out at any time. We do not send unsolicited marketing to people who are not clients without their consent.

4.9 Recruitment

To assess your application for employment, conduct background checks (with your consent), and contact you about the role.

4.10 Legal claims and disputes

To establish, exercise, or defend legal claims involving us or our clients.

05Legal bases for processing

Under Ghana's Data Protection Act 2012, we must have a legal basis for each processing activity. We rely on the following bases.

Where we rely on legitimate interests, we have weighed our interests against your rights and concluded that processing is necessary and proportionate. You can object to legitimate-interest processing at any time (see section 9).

06Who we share data with

We share personal data only where necessary to provide our services, comply with our legal obligations, or protect our legitimate interests. We do not sell personal data to anyone, ever.

• Partner banks — Ecobank Ghana, Stanbic Bank Ghana, GCB Bank, for settlement, custody, and where you have asked us to refer you to them for banking services they offer under their own Bank of Ghana licences.
• Custodians and registrars — licensed Ghanaian and international custodians and securities depositories that hold or register securities for our clients.
• Service providers — IT and cloud-hosting providers, email and SMS senders, document-verification services, sanctions-screening providers, payroll, telephony, and call-recording providers.
• Professional advisers — our external auditors, lawyers, tax advisers, and consultants, where they need access to do their work for us.
• Regulators and authorities — Securities & Exchange Commission of Ghana, Financial Intelligence Centre, Bank of Ghana, Ghana Revenue Authority, Data Protection Commission, courts, and law-enforcement agencies, where we are legally required or authorised to share information.
• Acquirers and investors — if our business is sold or restructured, your data may transfer to the acquiring party, subject to a binding obligation to honour this policy.

All third parties we share data with are bound by written agreements that require them to protect your data and use it only for the purposes we specify.

07International transfers

Some of the service providers and partners we work with are located outside Ghana. Where we transfer your personal data internationally, we put safeguards in place to protect it.

7.1 Where data may be transferred

• Reputable cloud-hosting and software-as-a-service providers, which may operate from data centres outside Ghana, including in countries that have been recognised as offering an adequate level of data protection
• Sanctions-screening providers, which may be based outside Ghana
• Where you are a diaspora client, your home country tax authorities under FATCA/CRS reporting

7.2 Safeguards

We rely on one or more of the following:

• The recipient country has been recognised by Ghana's Data Protection Commission as offering adequate protection
• The transfer is covered by Standard Contractual Clauses approved by the Commission or based on the European Commission's SCCs as adapted for Ghana
• The transfer is necessary for the performance of your contract with us
• You have given explicit consent to the transfer after being informed of the risks

7.3 EU/EEA and UK clients

If you are resident in the European Economic Area or the United Kingdom, the GDPR (or UK GDPR) will apply to your data in addition to Ghana's Data Protection Act. Where there is a conflict, we will apply the standard that gives you greater protection. You can contact our Data Protection Officer to ask about how we comply with GDPR for EEA/UK clients.

08How long we keep data

We keep personal data only for as long as we need it for the purposes for which we collected it, plus any retention period required by law.

After retention periods expire, we either delete the data, anonymise it (so it can no longer be linked to you), or archive it offline if there is a continuing legal need to keep it.

09Your rights

Ghana's Data Protection Act and (for EEA/UK residents) the GDPR give you the following rights over your personal data.

9.1 Right of access

You can ask us for a copy of the personal data we hold about you, along with information about how we use it.

9.2 Right to rectification

You can ask us to correct inaccurate or incomplete data.

9.3 Right to erasure

You can ask us to delete your data. This right is not absolute. We may have to keep certain data to meet legal obligations (for example, AML records for 6 years).

9.4 Right to restrict processing

You can ask us to limit how we use your data while a question about its accuracy or our use of it is being resolved.

9.5 Right to data portability

You can ask us to provide your data in a structured, machine-readable format, or to transfer it to another firm of your choice, where the processing is based on your consent or a contract.

9.6 Right to object

You can object to processing based on our legitimate interests, including objecting to direct marketing at any time.

9.7 Rights in relation to automated decision-making

We do not currently make any decisions about clients based solely on automated processing without human review. If we ever do, you will have the right to ask for human review.

9.8 How to exercise your rights

Email compliance@premiumcapitalgh.com with the heading "Data Subject Request" and tell us what right you want to exercise. We will verify your identity (to make sure we don't release your data to an impersonator) and respond within 30 days. If your request is complex, we may extend that period and will tell you why.

Exercising these rights is free in the first instance. We may charge a reasonable fee or refuse to respond if requests are manifestly unfounded or excessive.

10Cookies and tracking

Our website uses cookies and similar technologies to make the site work, understand how it is used, and improve it. See our separate Cookie Policy for full detail and how to control cookies.

11How we protect data

We use technical and organisational measures appropriate to the sensitivity of the data and the harm that could result from a breach.

• Encryption of data in transit (TLS 1.2 or above) and at rest where appropriate
• Multi-factor authentication for staff access to client data
• Role-based access control: staff see only the data they need for their role
• Periodic access reviews and revocation when staff change role or leave
• Regular vulnerability scanning and security testing
• Vendor due diligence before sharing data with service providers
• Documented breach response plan with notification to the Data Protection Commission within 72 hours of detection where required
• Staff training on data protection and information security
• Physical security at our offices and data-storage locations

No security measure is perfect. If a personal data breach is likely to result in a high risk to you, we will tell you about it without undue delay.

12Children

Our services are not directed at children under 18. We do not knowingly process the personal data of children under 18 except where a parent or legal guardian opens a junior investment account on their behalf, in which case the parent/guardian is the account holder and consents on the child's behalf to the limited data processing required.

13Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top tells you when. If we make significant changes, we will notify you by email (where we have your address) or through a prominent notice on the website at least 30 days before the changes take effect.

We will keep prior versions available on request so you can compare what has changed.

14How to contact us

Premium Capital Investment Ghana Limited
8th Floor, One Airport Square, Airport City, Accra, Ghana

Data Protection Officer: compliance@premiumcapitalgh.com
Customer support: customers@premiumcapitalgh.com
Phone: +233 30 274 6644

15How to complain

If you are not satisfied with how we handle your personal data, please tell us first by emailing our Data Protection Officer. We take complaints seriously and will investigate.

You also have the right to complain directly to:

• Data Protection Commission, Ghana — the supervisory authority for data protection in Ghana. Visit dataprotection.org.gh.
• Your local data-protection authority — if you are resident in the EEA, the UK, or another jurisdiction with its own supervisory authority, you may complain there.