10Dynamics Limited

Draft for legal and compliance review — not for publication

Effective date: [insert following approval]

 

1. Who we are and who this notice covers

 

10Dynamics Limited (“10Dynamics”, “we”, “us” or “our”) is the controller responsible for the personal data described in this notice.

 

Our registered address is 130 Wood Street, London EC2V 6DL, United Kingdom. Please contact enquiries@10dynamics.com with privacy questions or requests to exercise your data protection rights.

 

This notice covers personal data relating to:

 

• prospective, current and former investors and managed-account clients;

• individuals acting for those investors or clients;

• professional contacts;

• authorised due-diligence reviewers;

• users of our protected investor platform; and

• visitors to our public website and people who contact us.

 

It explains our processing of personal data under applicable UK data protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018, as amended.

 

2. Personal data we process

 

Depending on your relationship with us and your use of our services, we process:

 

• your verified email address and name;

• your assigned organisation, country and optional telephone number;

• your account status and access permissions;

• login and last-login information;

• audit events relating to account administration, access and security;

• document-review activity;

• questions or comments submitted through the due-diligence review register; and

• information contained in enquiries and other correspondence with us.

 

We obtain information directly from you, from your organisation or an authorised contact who arranges your access, and through your use of the website or investor platform.

 

Please avoid including unnecessary personal data about yourself or other people in review-register submissions.

 

[Legal/compliance review: confirm any additional identity-verification, client-administration, technical-log or other data categories actually processed, their sources, and any special-category or criminal-offence data before finalising this notice.]

 

3. Investor-platform authentication

 

The protected investor platform uses Cloudflare Access email one-time-passcode authentication. A code is sent to the email address used for authentication; users do not create a platform password.

 

Email verification establishes access to that email account. It does not, by itself, establish investor eligibility or grant unrestricted access. Access also depends on the account’s status, assigned organisation and permissions.

 

4. Why we use personal data

 

We process personal data for the following purposes:

 

• verifying identity and the association between a user and their organisation;

• controlling institutional access to protected materials;

• creating, administering, updating and closing accounts;

• maintaining security and investigating access or security issues;

• supporting due-diligence reviews, including document-review activity and review-register submissions;

• responding to enquiries and managing professional communications; and

• maintaining records required by applicable legal and regulatory obligations.

 

5. Lawful bases — for legal/compliance determination

 

This section must be completed before publication. The following are bases to assess, not a statement that every basis applies.

 

Processing purpose: Identity verification, access control, account administration and security

Basis requiring assessment and confirmation: Assess legitimate interests under Article 6(1)(f), identifying the specific interests and documenting necessity and the balancing assessment. Identify any processing instead required by a specific legal obligation.

 

Processing purpose: Due-diligence review and professional enquiries

Basis requiring assessment and confirmation: Assess legitimate interests. Consider Article 6(1)(b) only where processing is necessary for a contract with the individual, or steps requested by that individual before entering into a contract. A contract with their organisation alone does not establish this basis.

 

Processing purpose: Investor or managed-account administration

Basis requiring assessment and confirmation: Confirm the relevant relationship and processing. Assess contractual necessity where the individual is the contracting party, legitimate interests where appropriate, and any specific legal obligations.

 

Processing purpose: Regulatory recordkeeping

Basis requiring assessment and confirmation: Identify the actual obligation and the processing it requires before relying on Article 6(1)(c).

 

Processing purpose: Any processing relying on consent

Basis requiring assessment and confirmation: Identify the particular activity, how consent is obtained and recorded, and how it can be withdrawn. Do not treat website use or acceptance of this notice as consent.

 

[Legal/compliance review: replace this table with the confirmed purpose-by-purpose bases and, where applicable, the identified legitimate interests and statutory obligations. Confirm which information is legally or contractually required and explain the consequences of not providing it.]

 

Without the information needed to authenticate a user and administer their permissions, we may be unable to provide protected-platform access.

 

6. Service providers and other recipients

 

Cloudflare provides infrastructure and access-control services for the investor platform. These include Cloudflare Access for authentication and access control and, where used in the deployed platform, Workers for application processing, D1 for database storage and R2 for object and document storage.

 

[Legal/compliance review: confirm the deployed services, the personal data handled by each, the relevant Cloudflare contracting entity and its processor or other role under the applicable agreements. Do not imply that every listed data category is stored in every service.]

 

Personal data may also be accessible to authorised personnel and service providers where needed for the purposes described above. We may disclose information where required by law or to respond to a lawful request from a regulator or other competent authority.

 

[Legal/compliance review: confirm the actual recipient categories, including Wix’s role in the public website and enquiry form, email providers, professional advisers and any relevant compliance recipients. Confirm contractual protections and any sharing between organisations.]

 

7. Retention

 

We retain personal data only for as long as necessary for the purpose for which it is processed, taking account of applicable recordkeeping requirements and the establishment, exercise or defence of legal claims.

 

Account closure does not necessarily require immediate deletion of all associated records. Any continued retention must have a documented purpose and an appropriate retention period.

 

[Legal/compliance review: insert approved retention periods, or sufficiently specific criteria, for enquiries, account records, authentication and audit logs, document-review activity, review-register submissions and investor or client records. Confirm deletion or anonymisation arrangements, backup retention and legal holds. Do not assume a single period applies to all records.]

 

8. International transfers

 

Use of infrastructure or service providers may involve processing personal data outside the United Kingdom.

 

[Legal/compliance review: confirm whether restricted transfers occur, the relevant locations and recipients, and the safeguards actually relied upon. These may include applicable UK adequacy regulations or approved contractual safeguards, together with any required assessment and supplementary measures. Do not assume UK-only storage or processing.]

 

You can contact enquiries@10dynamics.com for information about applicable transfer safeguards and how to obtain a copy, subject to necessary redactions.

 

9. Security

 

Platform access is controlled through email one-time-passcode authentication and assigned permissions. Account and audit information supports access administration and security review.

 

No internet-based service can guarantee absolute security. Please keep your email account secure, do not share authentication codes, and notify enquiries@10dynamics.com promptly if you suspect unauthorised access.

 

[Legal/compliance review: confirm the implemented technical and organisational safeguards before adding claims about encryption, monitoring, backups or security standards.]

 

10. Cookies and similar technologies

 

The public website and investor platform may use cookies or similar technologies for authentication, session management and other functions.

 

[Legal/compliance review: complete a technology inventory and insert accurate information about purposes, providers, duration and user controls. Confirm which technologies require consent under applicable law. Do not describe analytics or other optional technologies as essential without assessment.]

 

11. Your rights

 

Depending on the circumstances and applicable law, you may have rights to:

 

• receive information about how your personal data is used;

• access your personal data;

• correct inaccurate or incomplete data;

• request erasure;

• restrict processing;

• object to processing;

• receive certain data in a portable format; and

• withdraw consent where processing relies on consent, without affecting the lawfulness of earlier processing.

 

These rights are subject to applicable conditions and exemptions. We may need proportionate information to verify your identity before responding.

 

[Legal/compliance review: confirm whether any processing involves solely automated decisions with legal or similarly significant effects, including any relevant access decisions, and insert the required explanation and safeguards. Do not retain an unverified blanket statement that no automated decision-making or profiling occurs.]

 

To exercise your rights, email enquiries@10dynamics.com.

 

You also have the right to complain to the UK Information Commissioner’s Office. Information on making a complaint is available at https://ico.org.uk/make-a-complaint/. You do not have to contact us before doing so.

 

12. Changes and contact

 

We may update this notice to reflect changes in our processing or applicable requirements. The approved notice will display its effective date. Where required, we will bring material changes to your attention.

 

Privacy contact: enquiries@10dynamics.com

10Dynamics Limited

130 Wood Street

London EC2V 6DL

United Kingdom

 

The risk of loss in trading futures is substantial and is not appropriate for all investors.