Privacy Policy &
Data Protection Notice

Operational Overview

Vendis Capital Group Financial (operating as part of Vendis Capital Management Group, Registered No. 0500.657.778, accessible via vendis.capital and invest.vendis.capital) is committed to safeguarding the privacy, confidentiality, and integrity of all client, shareholder, and user information.

This Privacy Policy outlines our data handling practices in accordance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU 2016/679), and relevant international data protection and financial compliance standards. This policy applies to all communications, investor portals, digital interactions, and distribution workflows managed across our domain infrastructure.

Categories of Data We Collect

Depending on whether you interact with us as an online visitor, prospective investor, or existing shareholder, we collect and process several categories of information:

• Identity & Contact Data: Full name, corporate title, residential or business address, email address, telephone number, national identity details, and proof of residence.
• Shareholding & Securities Data: Record of share certificates, shareholding volumes, Regulation S restricted status, Rule 144 positions, transaction histories, and transfer agent reference numbers.
• Financial & Compliance Data: Anti-Money Laundering (AML) / Know Your Customer (KYC) documentation, source of funds declarations, bank account verification details, and accreditation statements.
• Technical & Telemetry Data: IP addresses, browser types, server access log configurations, email interaction metrics (delivery logs, open tracking, link clicks via secure dispatch nodes), and website navigation paths.

Purpose & Lawful Basis for Processing

We process your personal information strictly under one or more of the following legally established grounds:

1. Contractual Necessity: To fulfill agreements between you and Vendis Capital Group Financial, including executing share transfers, preparing bespoke bond proposals, or delivering official issuer documentation.

2. Legal & Regulatory Compliance: To satisfy mandatory statutory obligations under securities regulation, financial oversight rules, AML/KYC laws, and corporate recordkeeping directives.

3. Legitimate Interests: To manage corporate outreach campaigns, maintain security across host servers on invest.vendis.capital, verify dispatch list integrity, and respond to institutional inquiries efficiently.

Reg S & Shareholder Communications

When distributing private placement prospectuses, compliance updates, or de-restriction instructions to shareholders, client records are strictly managed to preserve confidentiality. Data collected for shareholder audit trails is retained to confirm compliant regulatory delivery.

Technical Infrastructure & Security

We deploy robust technical and organizational security measures to protect client records against unauthorized access, disclosure, alteration, or destruction:

• Infrastructure Hardening: Web assets hosted on invest.vendis.capital utilize secured Linux server infrastructure operating CloudPanel environments, with restricted root access and continuous file permission monitoring.
• Transmission Encryption: All data transmitted to and from our web systems utilizes TLS/SSL transport security protocols.
• Email Security: Domain infrastructure is authenticated using DomainKeys Identified Mail (DKIM), Sender Policy Framework (SPF), and DMARC verification policies to prevent domain spoofing and intercept attempts.

Disclosures & Third-Party Processors

Vendis Capital Group Financial does not sell, rent, or trade client or shareholder contact lists. Information is shared strictly with essential operational and regulatory infrastructure providers, including:

• Bulk Relays & Infrastructure Providers: High-deliverability transactional SMTP relays (such as Mailgun Technologies) for sending official prospectuses, investor updates, and transactional receipts.
• Regulatory Authorities: Financial regulators, tax authorities, or law enforcement entities when required by law or binding court order.
• Legal Counsel & Transfer Agents: Qualified US and European securities attorneys and recognized stock transfer agents involved in executing Rule 144 or Reg S legend removals.

Data Retention & Storage Limits

Personal and financial records are stored for as long as necessary to satisfy the primary purpose for which they were collected. Statutory record retention rules require financial compliance logs, transaction histories, and shareholder register entries to be maintained for a minimum of 6 years following the termination of the account or transaction clearance.

Your Data Protection Rights

Under applicable UK and EU data protection regulations, you retain the following rights regarding your personal information:

• Right of Access: Request copy details of all personal data held regarding your account.
• Right to Rectification: Request correction of incomplete, out-of-date, or inaccurate data points.
• Right to Erasure ("Right to be Forgotten"): Request deletion of records where processing is no longer required, subject to statutory retention mandates.
• Right to Restrict or Object: Object to automated processing or request suspension of direct marketing dispatches.

Contact Data Controller

To exercise your rights, submit a data inquiry, or contact our Data Controller regarding your information, please use the contact details below: