Privacy Policy

1. About this policy

Roca VC Limited respects the privacy of website visitors, applicants, clients, investors, partners, representatives, beneficial owners, and other individuals whose personal information it handles. This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, how long we retain it, how we protect it, and the rights available to you.

This Policy applies to the Roca VC website, client portal, application processes, communications, and services that refer to it. Separate privacy notices may apply to employees, job applicants, contractors, or particular regulated services.

2. Who is responsible for your information?

The data controller is:

Roca VC Limited Registered jurisdiction: United Kingdom Company number: pending confirmation Registered office: England, United Kingdom Privacy email: privacy@rocavc.com Telephone (UK): +44 7474 625779

Where another Roca VC entity or external service provider is responsible for a particular service, its identity will be stated in the relevant agreement or notice.

3. Information we may collect

Identity information

Your name, date of birth, nationality, citizenship, photograph, signature, government identification number, passport, national identity card, driving licence, or residence permit.

Contact information

Your residential address, business address, email address, telephone number, and preferred communication method.

Verification and compliance information

Proof of address, tax residence, tax identification number, employment and occupation, company ownership, beneficial ownership, source of funds, source of wealth, bank statements, corporate records, sanctions information, politically exposed person status, adverse-media results, fraud-prevention information, and information required for AML, KYC, or regulatory checks.

Financial and transaction information

Bank-account details, payment information, wallet addresses, deposits, withdrawals, balances, transaction history, trading activity, investment activity, fees, commissions, and funding sources. We do not intentionally store full payment-card security codes.

Trading and investment information

Account type, trading experience, risk tolerance, investment objectives, professional-client information, financial circumstances, positions, orders, strategy preferences, platform activity, and suitability or appropriateness responses.

Corporate information

Where you represent a business, fund, partnership, trust, or institution, we may collect incorporation records, ownership charts, constitutional documents, licences, financial information, authorised signatory details, business activity, and information about directors, shareholders, trustees, partners, and beneficial owners.

Technical information

IP address, device type, browser type, operating system, login data, approximate location, session data, cookie identifiers, platform logs, security events, and interaction records.

Communication information

Emails, telephone calls, chat messages, support tickets, meeting notes, documents, complaints, and other communications. Calls may be recorded where permitted and where notice has been provided.

Marketing information

Your marketing preferences, campaign interactions, event attendance, enquiry history, and communication engagement.

4. How we collect information

We may collect personal information:

• Directly from you;
• From a company or representative acting for you;
• Through account or enquiry forms;
• During identity and compliance checks;
• From trading, payment, or transaction activity;
• From cookies and website technologies;
• From public registers and databases;
• From fraud-prevention, sanctions, PEP, identity, or credit-screening providers;
• From banks, payment providers, liquidity providers, custodians, brokers, and technology partners;
• From regulators, law-enforcement bodies, or courts; and
• From public sources, including professional websites and media.

5. Why we use personal information

We may process personal information to respond to enquiries; assess applications; verify identity and ownership; establish and manage a client or partner relationship; provide trading, liquidity, investment, technology, or support services; process deposits, withdrawals, fees, and transactions; conduct AML, KYC, fraud, sanctions, and security checks; monitor transactions and account activity; meet legal, regulatory, tax, accounting, and reporting obligations; manage risk and conflicts of interest; improve websites, systems, products, and client experience; protect our systems, users, and business; resolve complaints and disputes; enforce agreements; maintain records; send service communications; and send marketing where permitted.

6. Lawful bases

Depending on the activity and applicable law, we may rely on:

Contract

Processing may be necessary to enter into or perform a contract with you.

Legal obligation

Processing may be necessary to comply with legal, regulatory, AML, sanctions, tax, accounting, court, or reporting obligations.

Legitimate interests

We may process information where necessary for legitimate business interests, including operating and improving services, preventing fraud, maintaining network and information security, managing commercial relationships, maintaining business records, defending legal claims, and communicating with professional or institutional contacts. We consider whether these interests are overridden by your rights.

Consent

We may rely on consent for optional marketing, non-essential cookies, particular biometric processing, or other activities where consent is appropriate. You may withdraw consent at any time, without affecting processing completed before withdrawal.

Protection of vital interests

In limited circumstances, information may be processed to protect someone's life or physical safety.

7. Sensitive and criminal-offence information

Identity verification may involve facial images, biometric matching, or information revealing criminal allegations or convictions. Such information will only be processed where permitted by law and where an appropriate additional legal condition applies. Where an external verification provider performs biometric checks, its own privacy notice may also apply.

8. Automated checks and decisions

We may use automated tools to assist with identity verification, fraud detection, sanctions screening, risk scoring, transaction monitoring, account security, and application review. These tools may flag an application or transaction for manual review.

Where applicable law gives you rights concerning a decision based solely on automated processing that produces a legal or similarly significant effect, you may request human review and provide additional information.

9. Sharing personal information

We may share information with Roca VC group companies; identity-verification and KYC providers; sanctions and fraud-screening providers; banks and payment providers; card, wallet, or digital-asset service providers; brokers, liquidity providers, execution venues, custodians, and trading-platform providers; cloud, hosting, cybersecurity, analytics, CRM, email, communications, and document-storage providers; auditors, insurers, lawyers, accountants, and consultants; regulators, financial intelligence units, tax authorities, law-enforcement agencies, courts, and government bodies; counterparties involved in a transaction requested by you; and buyers, investors, or advisers involved in a merger, acquisition, restructuring, financing, or business transfer.

We do not sell personal information for an unrelated third party's independent marketing use.

10. International transfers

Roca VC Limited may operate or use service providers in the United Kingdom and other countries. Personal information may therefore be transferred outside the country where it was collected. Where international-transfer restrictions apply, we will use an available legal transfer mechanism, such as an adequacy regulation or recognised jurisdiction, contractual safeguards, binding arrangements, a legally permitted exception, or another approved transfer mechanism. You may contact us for more information about safeguards used for a particular transfer.

11. Data retention

We retain information only for as long as reasonably necessary for the purpose for which it was collected. Retention periods may be affected by AML and KYC obligations, regulatory requirements, tax and accounting rules, contractual limitation periods, fraud prevention, complaints, litigation, security requirements, and the need to establish or defend legal claims.

Compliance records may be retained after an application is declined or a relationship ends where required or permitted by law. When information is no longer required, it will be deleted, anonymised, or securely restricted.

12. Security

We use administrative, organisational, and technical controls designed to protect personal information. These may include access controls, authentication, encryption, secure hosting, staff confidentiality, monitoring, backups, vulnerability management, incident-response procedures, and vendor due diligence.

No internet-based system can be guaranteed completely secure. You must protect your account credentials and notify us promptly about suspected unauthorised access.

13. Your rights

Depending on your location and the applicable law, you may have the right to request access to personal information; correct inaccurate information; request deletion; restrict processing; object to processing; receive certain information in a portable format; withdraw consent; object to direct marketing; request human review of certain automated decisions; and complain to a data-protection authority.

These rights may be limited where information must be retained for legal, regulatory, AML, fraud-prevention, or legal-claim purposes. To exercise a right, contact privacy@rocavc.com. We may request information to verify your identity before responding.

14. Marketing communications

We may send relevant business or service information where permitted. Electronic marketing will be based on consent or another lawful basis where available. You may unsubscribe through the communication or contact us directly. Service, security, legal, and account communications are not marketing and may continue where necessary.

15. Cookies

We use cookies and similar technologies for security, functionality, preferences, analytics, and marketing. Non-essential technologies will be used subject to consent where required. More information is available in the Cookie Policy.

16. Children

Roca VC services are not intended for persons under 18. We do not knowingly open accounts for children. Contact us if you believe a child has submitted personal information.

17. External websites

Our website may link to external services. We are not responsible for the privacy practices of third-party websites. Review their privacy policies before providing information.

18. Complaints

You may first contact us at privacy@rocavc.com. Where UK data-protection law applies, you may also complain to the UK Information Commissioner's Office. You may also have the right to complain to the authority in the country where you live or work.

19. Changes to this policy

We may update this Policy to reflect changes in law, services, technology, or processing. The latest version will be published with a revised effective date.

Contact

Roca VC Limited Registered office: England, United Kingdom Company number: pending confirmation Privacy email: privacy@rocavc.com Telephone (UK): +44 7474 625779 Website: https://rocavc.com