Data Protection Policy

1. Purpose and Scope

This Policy sets out the obligations of Luna Wealth Asset Management Ltd (the "Company" or "LWAM"), a company incorporated in the Republic of Cyprus (Reg. No. HE 377224), authorised and regulated as a Cyprus Investment Firm by the Cyprus Securities and Exchange Commission ("CySEC") under Licence No. 379/19, with offices at 4 Fotti Pitta Str, 9th Floor, 1065 Nicosia, in respect of personal data processed under EU Regulation 2016/679 (the "GDPR") and the Cyprus Law 125(I)/2018.

The GDPR defines personal data as any information relating to an identified or identifiable natural person (a "data subject"): a person who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to that person's physical, physiological, genetic, mental, economic, cultural or social identity.

The Policy governs the collection, processing, transfer, storage and disposal of personal data by the Company. It applies to all directors, employees, agents, contractors and other parties acting on behalf of the Company, and is read together with the Company's Privacy Policy and with the documents listed in Section 15.

The Company is committed not only to the letter of the law but also to its spirit, and places high importance on the correct, lawful and fair handling of all personal data.

2. Data Protection Governance

No Data Protection Officer is appointed. The Company has performed the assessment required by GDPR Article 37 and concluded that the mandatory appointment criteria do not apply at LWAM's scale and processing profile: the Company is not a public authority, and its core activities involve neither regular and systematic monitoring of data subjects on a large scale nor large-scale processing of special categories of data. The assessment is on record and has been confirmed by the Company's external auditors.

The data protection function is held by the Executive Directors, supported by the Compliance Manager , who together

are responsible for:

• maintaining this Policy and the records of processing activities;
• assessing personal data breaches and making notifications to the Commissioner for Personal Data Protection within 72 hours where required (GDPR Art. 33) and to affected data subjects where required (Art. 34), operationally via the incident reporting route of the LWAM ICT Incident Response Plan;
• approving any new processing with elevated risk, including any business use of a generative-AI service with personal data (which additionally requires a DPIA);
• handling data subject requests;
• reviewing this Policy upon material change. Should the Company's processing profile change materially (in particular upon a substantial expansion of client monitoring or data categories), the Article 37 assessment is repeated and, if the criteria are met, a DPO is appointed.

Role-to-person mapping for every role named in this Policy is maintained exclusively in the LWAM Information Security & DORA Roles Register.

3. The Data Protection Principles

All personal data must be:

• processed lawfully, fairly and in a transparent manner in relation to the data subject;
• collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes (further processing for archiving in the public interest, scientific or historical research, or statistical purposes is not considered incompatible);
• adequate, relevant and limited to what is necessary in relation to the purposes of processing;
• accurate and, where necessary, kept up to date; every reasonable step must be taken to erase or rectify inaccurate data without delay;
• kept in a form which permits identification of data subjects for no longer than is necessary for the purposes of processing;
• processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical and organisational measures.

4. The Rights of Data Subjects

1. 1.The right to be informed;
2. 2.the right of access;
3. 3.the right to rectification;
4. 4.the right to erasure ("right to be forgotten");
5. 5.the right to restrict processing;
6. 6.the right to data portability;
7. 7.the right to object;
8. 8.rights with respect to automated decision-making and profiling.

The handling of requests under these rights is set out in Section 10.

5. Lawful, Fair and Transparent Processing

Processing of personal data is lawful where at least one of the following applies:

• the data subject has given consent for one or more specific purposes;
• processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the data subject's request prior to entering into a contract;
• processing is necessary for compliance with a legal obligation to which the Company is subject (including the Investment Services and Activities and Regulated Markets Law, AML/CFT obligations, and tax reporting such as FATCA and CRS);
• processing is necessary to protect the vital interests of the data subject or another natural person;
• processing is necessary for the performance of a task carried out in the public interest;
• processing is necessary for the purposes of the legitimate interests pursued by the Company or a third party, except where those interests are overridden by the fundamental rights and freedoms of the data subject.

The lawful basis relied on for each processing activity is recorded in the records of processing activities (Section 8).

Special category data. Where the personal data concerns racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data used for identification, health, sex life or sexual orientation, one of the conditions in GDPR Article 9(2) must additionally be met. In practice, LWAM does not require special category data for its services; the Company does not solicit such data, and it is processed only where a condition in Article 9(2) applies (typically explicit consent, employment or social security obligations, or the conduct of legal claims).

6. Purposes, Minimisation, Accuracy

Specified, explicit and legitimate purposes. The Company collects, processes and holds personal data only for the specific purposes of which data subjects have been informed, or for other purposes expressly permitted by the GDPR. This covers both personal data collected directly from data subjects and personal data obtained from third parties (including public registers, sanctions and PEP screening providers, and introducers).

Adequate, relevant and limited processing. The Company collects and processes personal data only to the extent necessary for those purposes.

Accuracy. Personal data is kept accurate and up to date, including by rectification at the request of a data subject. Accuracy is checked at collection and at regular intervals thereafter, in particular during periodic client due diligence reviews. Data found to be inaccurate or out of date is amended or erased without delay.

7. Data Retention

Personal data is not kept for longer than is necessary in light of the purposes for which it was collected, held and processed. Retention periods, including the statutory retention of client due diligence and transaction records (five years after termination of the business relationship, or longer where legal proceedings or investigations are ongoing), are set out in the LWAM Data Retention Policy, which is the single authoritative source for retention across the Company. When personal data is no longer required, it is securely deleted or destroyed in accordance with that Policy.

8. Accountability and Records of Processing

The Executive Directors, supported by the Compliance Manager, oversee implementation of this Policy and monitor compliance with it, with the GDPR and with other applicable data protection legislation.

The Company maintains written records of processing activities, which include:

• the name and details of the Company and of any applicable third-party data processors;
• the purposes for which personal data is collected, held and processed;
• the categories of personal data and the categories of data subject concerned;
• details of any transfers of personal data to third countries, including the transfer mechanism and safeguards;
• the retention periods applicable to each category;
• a description of the technical and organisational measures taken to ensure security. Processors acting on behalf of the Company are engaged under a written contract containing the provisions required by GDPR Article 28, and, where the processor is an ICT service provider, under the contractual requirements of the LWAM ICT Third- Party Risk Management Policy (DORA Article 30). The provider register and criticality classification are maintained in the LWAM Information Security & DORA Roles Register.

9. Data Protection Impact Assessments and New Processing

A Data Protection Impact Assessment ("DPIA") is carried out before any new project or new use of personal data that involves new technologies and is likely to result in a high risk to the rights and freedoms of data subjects.

A DPIA is mandatory, and prior approval by an Executive Director, with the Compliance Manager, is required, for:

• any business use of a generative-AI or other external AI service involving personal data (unapproved use is prohibited: LWAM Acceptable Use Policy §3);
• introduction of automated decision-making or profiling affecting clients (Section 11);
• large-scale processing of special category data;
• systematic monitoring of individuals.

Each DPIA addresses: the types of personal data concerned; the purposes of processing; the Company's objectives; how the data is to be used; the internal and external parties to be consulted; the necessity and proportionality of the processing; risks to data subjects; risks to and within the Company; and the measures proposed to minimise and manage the identified risks. Completed DPIAs are retained as compliance records.

10. Transparency and Handling of Data Subject Requests

10.1 Keeping data subjects informed

Where personal data is collected directly from data subjects, they are informed of the purpose at the time of collection. Where personal data is obtained from a third party, the data subject is informed: at the first communication with them; or before any onward transfer; or in any event no later than one month after the data is obtained.

The information provided includes: details of the Company; the purposes and lawful basis of processing; where applicable, the legitimate interests relied on; where data is not obtained from the data subject, the categories of data concerned; the recipients or categories of recipient; details and safeguards of any transfer outside the EEA; retention periods; the data subject's rights under the GDPR, including the right to withdraw consent at any time; the right to lodge a complaint with the Commissioner for Personal Data Protection; any legal or contractual requirement to provide the data and the consequences of not providing it; and details of any automated decision-making or profiling.

10.2 Making a request

Requests may be made at any time, in writing, addressed to the Company at 4 Fotti Pitta Str, 9th Floor, 1065 Nicosia, Cyprus, or by email to compliance@lunawealth.com. Requests are received and processed by the Compliance Manager; decisions on contested or complex requests are taken by the Executive Directors.

Requests are recorded in a register of data subject requests, together with the identity verification performed, the decision taken and the date of response.

10.3 Timescales and fees

Responses are provided within one month of receipt. Where a request is complex or where numerous requests are made, the period may be extended by up to two further months; the data subject is informed of the extension and its reasons within the first month.

No fee is charged for handling normal requests. The Company reserves the right to charge a reasonable fee for additional copies of information already supplied, and for requests that are manifestly unfounded or excessive, in particular where they are repetitive.

10.4 Access

Data subjects may request confirmation of whether the Company processes personal data about them, a copy of that data, and information about the processing (purposes, categories, recipients, retention, rights, source).

10.5 Rectification

Data subjects may require the Company to rectify personal data that is inaccurate or incomplete. The Company rectifies the data and informs the data subject within the timescales in Section 10.3. Where the affected data has been disclosed to third parties, those parties are informed of the rectification.

10.6 Erasure

Data subjects may request erasure of their personal data where:

• it is no longer necessary for the purposes for which it was collected or processed;
• the data subject withdraws consent, where consent was the lawful basis (withdrawal is notified in writing to compliance@lunawealth.com);
• the data subject objects and there is no overriding legitimate interest;
• the personal data has been processed unlawfully;
• erasure is required for compliance with a legal obligation.

Requests for erasure are complied with, and the data subject informed, within the timescales in Section 10.3, unless the Company has lawful grounds to refuse — in particular where retention is required by AML/CFT, CySEC or tax legislation, or for the establishment, exercise or defence of legal claims. Where refusal is based on such grounds, the reasons are given to the data subject. Where erased data has been disclosed to third parties, those parties are informed unless this is impossible or would require disproportionate effort.

10.7 Restriction of processing

Where a data subject requests restriction of processing, the Company retains only the amount of personal data necessary to ensure that the data in question is not processed further. Where the affected data has been disclosed to third parties, those parties are informed of the restriction unless this is impossible or would require disproportionate effort.

10.8 Portability

Where technically feasible and where the request is made in respect of data provided by the data subject and processed on the basis of consent or contract, personal data is provided in a structured, commonly used, machine-readable format or transmitted directly to another controller. Requests are complied with within the timescales in Section 10.3.

10.9 Objection

Data subjects have the right to object to processing based on legitimate interests, and to direct marketing (including profiling for direct marketing purposes).

Where the objection concerns processing based on legitimate interests, the Company ceases that processing immediately unless it can demonstrate that its legitimate grounds override the data subject's interests, rights and freedoms, or that the processing is necessary for the conduct of legal claims. Where the objection concerns direct marketing, processing ceases immediately.

11. Automated Decision-Making and Profiling

The Company does not currently use personal data for automated decision-making or for profiling. Should this change, prior approval and a DPIA are required (Section 9) and the following applies.

Where an automated decision has a legal or similarly significant effect on a data subject, that data subject has the right to challenge the decision, to request human intervention, to express their point of view and to obtain an explanation of the decision. This right does not apply where the decision is necessary for entering into or performing a contract between the Company and the data subject, is authorised by law, or is based on the data subject's explicit consent.

Where profiling is introduced: clear information explaining the profiling, including its significance and likely consequences, is provided to data subjects; appropriate mathematical or statistical procedures are used; technical and organisational measures are implemented to minimise the risk of errors and to enable their correction; and all personal data processed for profiling purposes is secured to prevent discriminatory effects.

12. Security of Processing

The Company ensures that all personal data collected, held and processed is kept secure and protected against unauthorised or unlawful processing and against accidental loss, destruction or damage.

The technical and organisational security controls that protect personal data are those of the Company's information security framework and are not restated here. The authoritative sources are:

Management Procedure

Data-protection-specific requirements that apply in addition:

1. 1.Purpose-bound access. Only those who need access to personal data to carry out their assigned duties have such access. Access is granted and revoked through the access-control process of the Information Security Policy and the Joiner/Mover/Leaver Process; requests for access beyond a person's role are approved by an Executive Director or the Compliance Manager.
2. 2.No informal sharing. Personal data is not shared informally or transferred to any employee, agent, contractor or other party, whether or not acting on behalf of the Company, without authorisation under point 1 and, for external recipients, a lawful basis and a written contract (Section 8).
3. 3.Handling. Personal data is not left unattended or visible to unauthorised persons; screens are locked when a workstation is left unattended.
4. 4.Client data on personal devices. Personal data is not transferred to devices personally belonging to employees. Transfer to devices belonging to agents or contractors is permitted only where that party is contractually bound to comply with this Policy and the GDPR, and is managed in accordance with the Mobile and Devices Teleworking Policy.
5. 5.Marketing. Where personal data is used for marketing purposes, the Compliance Manager verifies that the appropriate consent exists and that no data subject has opted out, whether directly or through a third-party service.

13. Organisational Measures

• All directors, employees, agents, contractors and other parties acting on behalf of the Company are made aware of their individual responsibilities and of the Company's responsibilities under the GDPR and this Policy, and are provided with a copy of this Policy.
• All persons handling personal data receive appropriate data protection training as part of the annual security and compliance awareness programme, and are appropriately supervised.
• All persons handling personal data are required to exercise care, caution and discretion when discussing matters relating to personal data, whether in the workplace or elsewhere.
• Methods of collecting, holding and processing personal data are evaluated and reviewed periodically, and the personal data held is reviewed periodically against the retention schedule.
• All persons handling personal data on behalf of the Company are bound by contract to do so in accordance with the GDPR and this Policy; agents and contractors must hold their own personnel to equivalent conditions.
• Where an agent, contractor or other party acting on behalf of the Company fails in its obligations under this Policy, that party indemnifies and holds the Company harmless against any costs, liability, damages, loss, claims or proceedings arising out of that failure.

14. Transfers of Personal Data Outside the EEA

The Company may from time to time transfer personal data to countries outside the EEA ("transfer" includes making data available remotely, for example through a cloud service or remote support). Such a transfer takes place only where one or more of the following applies:

• the transfer is to a country, territory, sector or international organisation covered by a European Commission adequacy decision;
• appropriate safeguards are in place, in particular Standard Contractual Clauses adopted by the European Commission, binding corporate rules, an approved code of conduct or certification mechanism, supported where necessary by a transfer impact assessment and supplementary measures;
• the transfer is made with the informed consent of the data subject;
• the transfer is necessary for the performance of a contract between the data subject and the Company, or for pre-contractual steps taken at the data subject's request;
• the transfer is necessary for important reasons of public interest;
• the transfer is necessary for the conduct of legal claims;
• the transfer is necessary to protect the vital interests of a data subject who is physically or legally unable to give consent; or
• the transfer is made from a public register. Third-country transfers arising from the use of ICT service providers are identified and assessed under the ICT Third-Party Risk Management Policy, and the applicable mechanism is recorded in the records of processing activities (Section 8) and in the provider register.

15. Personal Data Breaches

A personal data breach is any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Every suspected personal data breach is reported immediately through the incident reporting route of the LWAM ICT Incident Response Plan; the authoritative GDPR breach procedure is this Section. In summary:

1. 1.The person who discovers the event reports it without delay and without attempting to resolve it alone.
2. 2.The Compliance Manager assesses notifiability against GDPR Articles 33 and 34, with technical input from the CISO and the ICT provider.
3. 3.The Executive Directors decide and notify: the Commissioner for Personal Data Protection without undue delay and in any event within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of data subjects; and, where the breach is likely to result in a high risk, the affected data subjects directly and without undue delay (with communication handled under the Crisis Communication Plan).
4. 4.Where a breach is not notified, the assessment and its reasons are recorded.
5. 5.All breaches, notifiable or not, are recorded in the incident register, and the review outcomes feed the Information Security Risk Assessment.

A notification to the Commissioner includes: the categories and approximate number of data subjects concerned; the categories and approximate number of personal data records concerned; the name and contact details of the Company's contact point; the likely consequences of the breach; and the measures taken or proposed to address the breach, including measures to mitigate its adverse effects.

Where an ICT incident also constitutes a personal data breach, the GDPR notification obligations under this Section run in parallel with, and independently of, the DORA incident reporting obligations to CySEC set out in the Incident Response Plan.

Appendix A — Data Processing Consent Form (Natural Person)

DATA PROCESSING CONSENT

Luna Wealth Asset Management Ltd ("LWAM") will process your personal data in order to review your application for the establishment of a business relationship with LWAM and to enable the provision of investment services, as defined by the Investment Services and Activities and Regulated Markets Law 87(I)/2017, if your application is successful. In accordance with the GDPR, LWAM processes your personal data on the following legal bases:

• consent;
• performance of a contract;
• compliance with a legal obligation;
• the legitimate interests pursued by LWAM. In order to establish a business relationship with LWAM, the following personal data is required from you:
• personal information such as your name, date and place of birth, citizenship, nationality, home address, passport or ID number, FATCA/CRS information (tax residency, tax identification number), contact details (telephone, email), bank account details, occupation, and information on whether you hold or have held a prominent public function (PEP);
• financial information such as your income, source of funds and investment objectives;
• documents verifying your identity, residency and financial information, such as an international passport or national ID and utility bills or bank statements. I, ............................................................, hereby grant my consent to the processing of my personal data, as defined by the General Data Protection Regulation (GDPR), by Luna Wealth Asset Management Ltd, a company limited by shares, duly registered under the laws of Cyprus with registration number HE 377224 and with its offices at 4 Fotti Pitta Str, 9th Floor, 1065 Nicosia, Cyprus. Furthermore, I consent that LWAM, as data controller, may also process my personal data through a data processor — its representative, agent and/or affiliate, where relevant — or provide or make such data available to such companies in line with the processes set out in the Data Protection Policy of Luna Wealth Asset Management Ltd. By signing this consent form, I agree and consent to LWAM collecting, processing, recording and holding my personal data, carrying out any operation or set of operations on my personal data, including organising, adapting, altering, retrieving, consulting and using my personal data, or aligning and sharing my personal data internally or externally, and disclosing my personal data to supervisory or public authorities upon request or where required, to service providers and relevant third parties of LWAM, by transmission, dissemination or otherwise making it available, combining, blocking, erasing or destroying my personal data in the manner set forth in the Data Protection Policy of Luna Wealth Asset Management Ltd. I hereby acknowledge that I have read and understood the Data Protection Policy of Luna Wealth Asset Management Ltd, as published at www.lunawealth.com, and that I have understood my rights regarding my personal data controlled and processed by LWAM. I hereby acknowledge that my personal data will be kept by LWAM for the duration of our business relationship and for five years after its termination, unless there are ongoing legal proceedings or investigations, in which case the retention of personal data may be longer. Signature: ............................................................ Name: ............................................................ Date: ............................................................ Luna Wealth Asset Management Ltd is an Investment Firm authorised and regulated by the Cyprus Securities and Exchange Commission (CySEC), Licence No. 379/19.