Legal

Privacy Policy

Effective date: February 18, 2026

We collect only what is necessary to run the Platform. We do not sell your data, build advertising profiles, or share your questionnaire responses with financial institutions or third parties.

1. Who We Are

WITYA ("we", "us", "our") operates the WITYA investor profiling platform accessible at this domain. We are the data controller responsible for the personal data you provide when using the Platform. If you have any questions about this Privacy Policy or about how we handle your data, please contact us at privacy@witya.com.

2. Data We Collect

We collect only the minimum data necessary to provide the service: • Email address — provided voluntarily during account registration, used solely to identify your account and deliver one-time login codes. • Questionnaire responses — the answers you submit through the investor profiling questionnaire. These responses are used exclusively to generate your investor profile result. • Session data — technical identifiers (session IDs) that track the progress and completion state of your assessment. • Usage data — standard server logs including IP address, browser type, and page access times, retained for security and operational purposes only. We do not collect payment information, government identity documents, financial account details, or any sensitive personal data as defined under applicable data protection law.

3. How We Use Your Data

We use the data we collect for the following purposes: (a) Authentication — to verify your identity via email and one-time code, and to maintain your login session. (b) Service delivery — to process your questionnaire responses and generate your investor profile. (c) Session continuity — to allow you to resume an incomplete assessment and to store your completed results. (d) Security and fraud prevention — to detect and prevent unauthorised access to accounts. (e) Platform improvement — aggregated, anonymised usage statistics to understand how the Platform is used and to improve its functionality. We do not use your data for automated decision-making that produces legal or similarly significant effects, nor to build advertising profiles.

4. Legal Basis for Processing

We process your personal data on the following legal bases under applicable data protection law: • Contract performance — processing your email address and questionnaire responses is necessary to provide the service you have requested. • Legitimate interests — processing usage logs and session data to maintain the security and performance of the Platform, provided this does not override your rights and freedoms. • Consent — where we request your agreement before processing data for any purpose beyond those listed above, such as sending optional communications.

5. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data to any third party. We may share data with trusted service providers who assist us in operating the Platform (for example, cloud hosting providers). Such providers are bound by contractual obligations to process data only on our instructions and in accordance with applicable law. We may disclose your data if required to do so by law, court order, or regulatory authority, or where necessary to protect the rights, property, or safety of WITYA, its users, or the public. No questionnaire responses or profile results are shared with financial institutions, investment firms, or any commercial third party.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the service. You may request deletion of your account and associated data at any time by contacting privacy@witya.com. Upon a valid deletion request, we will erase your personal data within 30 days, except where retention is required by law or for legitimate security purposes. Anonymised, aggregated data derived from questionnaire responses may be retained indefinitely as it cannot be used to identify you.

7. Cookies and Tracking

The Platform uses only essential cookies required for authentication and session management. We do not use advertising cookies, third-party tracking pixels, or behavioural analytics tools that profile individual users. You may disable cookies through your browser settings, but doing so may prevent you from logging in or using core Platform features.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These include encrypted data transmission (HTTPS), access controls, and regular security reviews. Email addresses are never stored in plain text. They are processed through a one-way cryptographic hash before being written to our database, meaning we do not hold a readable copy of your email address at rest. No method of transmission over the internet is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data: • Right of access — to request a copy of the personal data we hold about you. • Right to rectification — to request correction of inaccurate or incomplete data. • Right to erasure — to request deletion of your data, subject to legal obligations. • Right to restriction — to request that we limit the processing of your data. • Right to portability — to receive your data in a structured, machine-readable format. • Right to object — to object to processing based on legitimate interests. • Right to withdraw consent — where processing is based on consent, to withdraw it at any time without affecting prior processing. To exercise any of these rights, contact us at privacy@witya.com. We will respond within 30 days. We may ask you to verify your identity before fulfilling a request.

10. Children

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will delete it promptly.

11. International Transfers

If your data is transferred to or processed in a country outside your jurisdiction, we will ensure that appropriate safeguards are in place in accordance with applicable data protection law, such as standard contractual clauses approved by the relevant supervisory authority.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page. Where changes are material, we will notify you by email or by a prominent notice on the Platform. Continued use of the Platform after changes are posted constitutes your acceptance of the revised Policy.

13. Contact and Complaints

For any privacy-related queries or to exercise your rights, contact us at privacy@witya.com. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.