Privacy Policy

HW Legacy Group ("we", "us", "our") is the data controller responsible for your personal data collected through this website (hwlegacy.group). If you have questions about how we use your data, please contact us at invest@hwlegacy.group.

We collect the following categories of personal data: Identity data: full name, date of birth, National Insurance number, copies of government-issued ID (passport/driving licence). Contact data: email address, phone number, postal address. Financial data: investment amount, source of funds, bank account details for interest and principal payments. Technical data: IP address, browser type, pages visited, and time spent on the site (via cookies and analytics). Communications: any messages you send us via our contact form or email.

We collect data directly from you when you: • Register for an account on our website • Complete an investor application • Sign an investment agreement • Contact us via our contact form or email • Browse our website (automatically, via cookies) We do not purchase personal data from third parties.

We use your personal data for the following purposes: To process your investor application and carry out required KYC/AML checks. To manage your investment, including sending interest payments and returning principal at maturity. To communicate with you about your account, application status, and investment. To comply with legal and regulatory obligations (including anti-money laundering legislation). To improve our website and services using anonymised analytics data. To send you relevant investment updates or opportunities (with your consent, where required).

We process your personal data on the following legal bases: Contract: processing necessary to enter into and perform your investment agreement. Legal obligation: processing required to comply with KYC, AML, and other legal requirements. Legitimate interests: improving our website and services, preventing fraud and financial crime. Consent: for marketing communications, where required by law.

We may share your personal data with: Identity verification providers: for KYC and AML checks. Legal and professional advisers: solicitors, accountants, and compliance consultants acting on our behalf. Regulatory authorities: if required by law or court order. IT service providers: hosting, email, and analytics platforms that process data on our behalf under appropriate data processing agreements. We do not sell your personal data to third parties.

Some of our service providers may process your data outside the UK. Where this occurs, we ensure appropriate safeguards are in place (such as UK Standard Contractual Clauses or adequacy decisions) in accordance with UK GDPR.

We retain your personal data for as long as necessary to: • Manage your investment and any ongoing contractual obligations • Comply with legal and regulatory requirements (AML records are retained for a minimum of 5 years from the end of the business relationship) • Resolve disputes and enforce agreements Once retention periods expire, your data is securely deleted or anonymised.

Under UK GDPR you have the right to: • Access: request a copy of the personal data we hold about you. • Rectification: ask us to correct inaccurate data. • Erasure: request deletion of your data in certain circumstances. • Restriction: ask us to restrict processing in certain circumstances. • Portability: receive your data in a machine-readable format. • Object: object to processing based on legitimate interests. • Withdraw consent: where processing is based on consent, withdraw it at any time. To exercise any of these rights, please email invest@hwlegacy.group. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We use cookies and similar technologies to: • Maintain your login session • Remember your preferences • Analyse site usage via anonymised analytics You can control cookies through your browser settings. Disabling cookies may affect the functionality of the website. A full cookie policy is available on request.

We take the security of your personal data seriously and use appropriate technical and organisational measures to protect it against unauthorised access, loss, or disclosure. This includes encrypted data transmission (HTTPS), role-based access controls, and regular security reviews. However, no method of transmission over the internet is completely secure. We cannot guarantee absolute security.

We may update this Privacy Policy from time to time. The current version will always be available on our website with the "last updated" date shown above. We will notify you of material changes by email where we hold your contact details.

For any privacy-related queries, to exercise your rights, or to make a complaint, please contact: HW Legacy Group Email: invest@hwlegacy.group Website: hwlegacy.group/contact