Privacy Policy

01Scope of this policy

This Privacy Policy explains how Allitas (“Allitas”, “we”, “us” or “our”) collects, uses, shares and protects personal information when you visit allitas.com, create or use an investor account, access the investor portal or communicate with us.

It applies to the Service described in our Terms of Service. It does not apply to third-party websites, applications or services that we do not control.

By using the Service, you acknowledge that we will handle your information as described in this policy.

02Who we are

Allitas is responsible for the personal information described in this policy. You can reach us at [email protected] or through the support page in the investor portal.

03Information we collect

Information you give us

• Account details — name, email address, phone number, country, password (stored as a salted hash) and, where applicable, a referral code.
• Identity and verification information — date of birth, address, identification documents and verification results where we ask for them.
• Financial information — deposit and withdrawal requests, payment references, share purchases, holdings, dividend payments and referral rewards.
• Communications — support tickets, emails, feedback and survey responses.

Information we collect automatically

• Sign-in and security data — sign-in times, failed attempts, two-factor and withdrawal PIN status, session and device information, and IP address.
• Usage and technical data — browser and operating system type, pages viewed, approximate location derived from your IP address, and error logs.

Information from other sources

We may receive information from identity verification providers, payment providers, referral relationships and publicly available sources where lawful.

We do not ask for or store full payment card numbers or online banking passwords.

04How we use information

• Provide, operate and administer the Service and your account;
• verify your identity, eligibility and source of funds;
• process deposits, withdrawals, share subscriptions and dividend payments, and maintain accurate holding records;
• protect accounts and the Service, detect and prevent fraud, misuse, money laundering and sanctions breaches;
• send service messages, security alerts, statements and administrative notices;
• respond to your questions, requests and complaints;
• comply with legal, tax, accounting and regulatory obligations and enforce our Terms;
• administer referral rewards and verify eligibility; and
• improve the Service and develop new features using aggregated or de-identified information.

We do not sell your personal information, and we do not use it for third-party advertising.

05Legal bases

Where a legal basis is required, we rely on one or more of the following:

• Performance of a contract — to provide the Service and administer your account;
• Legal obligation — to meet record-keeping, tax, anti-money laundering and regulatory requirements;
• Legitimate interests — to secure the Service, prevent fraud, improve our offering and communicate with you, where those interests are not overridden by your rights;
• Consent — for optional communications or where required by law; and
• Vital interests or other lawful bases — where applicable.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before you withdrew.

06Sharing and disclosure

• Service providers — hosting, email delivery, identity verification, payment processing and IT support providers, bound by contracts that limit their use of your information.
• Professional advisers — legal, accounting, audit and compliance advisers where necessary.
• Regulators and authorities — where required or permitted by law, including anti-money laundering, sanctions, tax and law enforcement requests.
• Business transfers — to a successor or acquirer in connection with a merger, acquisition or transfer of assets, subject to appropriate confidentiality.
• With your direction — where you ask us to share information or give consent.

We may also share aggregated or de-identified information that cannot reasonably be used to identify you.

07Cookies and local storage

The Service uses a limited set of browser storage:

• Session cookies — keep you signed in and protect your session while you use the portal;
• Security tokens — protect forms against cross-site request forgery;
• Remember-me cookie — only if you select “Remember me” when signing in; and
• Local storage — stores your light or dark theme preference under the key allitasDark. It contains no personal information.

We do not set advertising or cross-site tracking cookies. You can control or delete cookies through your browser settings, but blocking session cookies will prevent you from signing in.

08How we protect information

We use technical and organisational measures designed to protect personal information, including encrypted connections, salted password hashing, optional two-factor authentication, withdrawal PINs, session expiry and revocation, role-based access and audit logging.

Access to personal information is limited to personnel and providers who need it to perform their duties. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You should protect your credentials and notify us promptly if you suspect unauthorised access.

If we become aware of a breach affecting your rights, we will notify you and the relevant regulator where required by law.

09How long we keep information

We keep personal information for as long as your account is active and for a period afterwards as required by law or as necessary for our legitimate interests.

• Financial, transaction and identity records are retained to meet tax, accounting, anti-money laundering and audit obligations.
• Security and access logs are kept for shorter periods unless needed to investigate an incident.
• Records may remain in backups for a limited period before being deleted or anonymised.

When information is no longer required, we delete it or anonymise it so that it can no longer be associated with you.

10Your rights

Depending on the law that applies to you, you may have the right to:

• access the personal information we hold about you;
• correct inaccurate or incomplete information;
• request deletion of your information;
• restrict or object to certain processing;
• receive a portable copy of information you provided;
• withdraw consent where processing is based on consent; and
• complain to your local data protection authority.

To exercise a right, contact us at [email protected]. We may ask you to verify your identity before acting on a request, and we may decline or limit a request where the law permits or requires us to do so — for example, to meet record-keeping obligations or defend legal claims. We will respond within the timeframe required by applicable law.

11International transfers

We may process and store information in countries other than the one in which you live. Where we transfer personal information internationally, we use safeguards required by applicable law, such as contractual protections or transfers to jurisdictions recognised as providing adequate protection. Contact us for more information about the safeguards we use.

12Children

The Service is intended for people aged 18 and over. We do not knowingly collect personal information from children. If you believe a minor has created an account, please contact us and we will take steps to close the account and delete the information.

13Third-party links

The Service may contain links to websites or services operated by third parties. We are not responsible for their privacy practices, and we encourage you to review their policies before providing personal information.

14Changes to this policy

We may update this policy from time to time. Where a change is material, we will post the updated policy and, where appropriate, notify you through the portal or by email before it takes effect. The effective date is shown at the top of this page.

By continuing to use the Service after the effective date, you acknowledge the updated policy.

15Contact and complaints

For privacy questions or requests, contact Allitas at [email protected] or through the support page in the investor portal.

If you are not satisfied with our response, you may complain to your local data protection authority. For your security, never send your password, two-factor codes, withdrawal PIN or full identity documents by email.