Privacy starts
with clarity.

Aster & Co. is the proposed controller for applications, client relationships, managed-investment records, and its website. This notice uses an EU/EEA operating model under Regulation (EU) 2016/679 (GDPR), supplemented by the controller’s applicable national laws. It covers applicants, clients, beneficial owners, representatives, visitors, and people who contact the firm.

The specific EU legal entity, registered office, establishment member state, and registration details remain unconfirmed. The London address elsewhere in this template is a fictional correspondence placeholder, not an EU registered office. No lead supervisory authority or data protection officer appointment is invented.

The proposed service collects the following information only where relevant to a specified purpose:

• Identity: legal name, date of birth, nationality, identity-document number and copy, address evidence, and verification results.
• Contact and account: email, telephone, correspondence address, account identifier, authentication records, and authorised representatives.
• Financial and tax: bank-account details, tax residence and identifiers, source of funds/wealth where required, employment, beneficial ownership, and payment references.
• Investment: objectives, knowledge and experience, financial position, capacity for loss, preferences, agreed mandate, holdings, orders, executions, fees, statements, and withdrawals.
• Interaction and technical: support messages, complaints, consent records, IP address, browser/device information, login events, and security logs.

The proposed model does not use biometric face matching, voiceprints, health records, or telephone recording. If any is introduced, its necessity, lawful conditions, information notice, retention, and safeguards must be established first. An ordinary identity-document photograph is not automatically biometric special-category data; technical identification processing changes that assessment. Criminal-offence screening requires an Article 10 basis under applicable EU or member-state law.

Information comes from your application, profile updates, mandate, payments and investment activity, and communications. Representatives may supply details about people they are authorised to act for. Public company/beneficial-ownership registers and lawful sanctions or politically exposed person sources may support verification.

Proposed external sources are identity-verification providers, sending/receiving banks, brokers, custodians, and screening providers. Actual companies are not yet selected and are not represented as connected. The operational notice will identify them or the relevant recipient/source categories accurately. Indirect-collection information will be supplied within GDPR Article 14 timescales unless a valid exception applies.

The proposed purpose-to-basis map is:

Identity, required verification, and mandate information are necessary for the relevant service; without them an application or transaction may not proceed. Marketing is optional. Accepting terms is not consent to unrelated processing. The proposed model does not rely on consent to avoid mandatory financial-record duties.

Information is disclosed only as necessary for these purposes: identity/screening providers receive verification details; banks/payment institutions receive payment instructions; brokers/custodians receive account and transaction information; hosting/support providers process relevant system or enquiry data; professional advisers receive information needed for advice or claims; competent authorities receive legally required disclosures.

Processors must have Article 28 agreements, confidentiality and security obligations, controlled subprocessing, and return/deletion terms. Banks, custodians, and authorities may act as independent controllers for their own legal purposes. Joint-controller arrangements, if introduced, require transparent allocation of responsibilities.

The proposed policy excludes sale of personal data, advertising-audience uploads, cross-site behavioural marketing, and disclosure of client details to investment projects merely because Aster invests in them. Any necessary investor disclosure for a particular structure must be explained before commitment. Actual providers and roles will be recorded in a recipient register before onboarding begins.

The proposed default is EEA hosting and EEA-based access for client records. This is an operating requirement to implement, not a statement about selected infrastructure. A non-EEA support session or subprocessor can still create a transfer even when storage is in Europe.

Before transferring outside the EEA, the firm will document the destination, recipient, purpose, and lawful route. Where applicable, use an Article 45 adequacy decision; otherwise assess appropriate Article 46 safeguards such as the Commission’s applicable standard contractual clauses, with transfer-impact assessment and supplementary measures where needed. If adequate protection cannot be achieved, do not proceed.

Consent is not the default workaround for routine outsourced transfers. A copy or explanation of applicable safeguards may be requested from the Privacy Team, with justified redactions. No SCC or adequacy coverage is asserted for an unnamed provider.

The following are concrete proposed policy periods, not universal EU legal deadlines. Before adoption, the establishment member state’s AML, investment, tax and limitation rules must be mapped to each class. A documented mandatory period overrides a shorter proposal; do not retain an entire account indefinitely because one record is subject to a hold.

Deletion or effective anonymisation follows expiry. A hold must record its reason, scope, owner, and review date. GDPR itself does not impose one fixed retention period for all financial-client data.

Depending on the applicable law, basis, and circumstances, you may have rights to:

Rights are not all absolute. Financial-record duties, other people’s rights, or legal exemptions can affect a request. The controller should explain any refusal or limitation and the available complaint route. A privacy notice cannot waive your statutory rights.

Use the verified Privacy Team channel to request access, correction, deletion, restriction, portability, objection, or consent withdrawal. Requests can be made in ordinary language. State the relevant account or relationship and what you need; we will ask for proportionate verification only where needed.

The proposed handling procedure logs requests on receipt, acknowledges them within five working days, and responds without undue delay and normally within one month. GDPR allows up to two additional months where necessary because of complexity or number of requests, with reasons given within the first month. The five-working-day acknowledgement is a proposed service target, not the GDPR deadline.

Requests are normally free. Any fee, refusal, identity-related timing issue, or exemption must meet GDPR conditions and be explained. You may complain to the supervisory authority in your habitual residence, place of work, or place of alleged infringement, and seek a judicial remedy. Find the relevant authority in the EDPB directory ↗. No exclusive authority is selected before the member state is known.

The proposed operating model requires meaningful human review of account rejection, suitability decisions, and material account restrictions. Screening alerts may support a decision but are not treated as proof of wrongdoing. The client can ask for a review and correct inaccurate information.

No solely automated decision producing legal or similarly significant effects is proposed. Introducing one requires a separate Article 22 assessment, a valid permitted condition, clear information about meaningful logic and consequences, and applicable safeguards including human intervention, representations, and challenge. Special-category use requires additional conditions.

Investment algorithms executing a valid mandate and automated decisions about an individual are not automatically the same activity; each actual processing operation must be assessed. This template has no connected AI, identity-screening or automated approval system.

The proposed EU policy is to obtain prior opt-in for analytics, advertising, and optional embedded services that access or store device information unless the applicable national exception has been verified. Strictly necessary technologies are limited to functions explicitly requested by the user. Optional choices are separate, off by default, and as easy to reject or withdraw as accept.

No consent manager is connected. A live cookie inventory must state actual names, providers, purposes, categories, and expiry for every deployed technology. This page and the other redesigned pages currently request Google Fonts; legacy screens can load chat, translation, CAPTCHA, or chart providers. These are not covered by a claim of “no third parties” and need their own resource/consent audit.

The proposed marketing model is opt-in email only, with unsubscribe in every campaign and no bought lists or retargeting audiences. Service and legal notices remain separate from marketing. Suppression prevents a withdrawn address being silently resubscribed.

The proposed baseline requires TLS for transmission, encryption of stored client records where appropriate, staff multi-factor authentication, role-based least-privilege access, quarterly access reviews, confidentiality training, vulnerability management, secure backups, and documented supplier and incident procedures. These are requirements to implement and test, not audited claims about the prototype.

All suspected personal-data breaches are recorded and assessed. Notify the competent authority without undue delay and, where feasible, within 72 hours of awareness unless the breach is unlikely to risk individuals’ rights and freedoms. Explain a late notification. Notify affected individuals without undue delay when high risk requires it, subject to lawful exceptions. Providers must notify the controller without undue delay.

Assess high-risk processing before deployment, including a DPIA where required. Security measures reduce risk; they do not guarantee absolute confidentiality or prevent every incident.

The proposed service accepts adults only. It does not offer junior accounts, target children, or seek parental consent to market investments to minors. If a minor’s information is submitted, restrict use to establishing the facts and applying an appropriate deletion or lawful retention decision.

EU GDPR is the baseline of this policy. National ePrivacy, AML, investment, and consumer rules remain relevant. An EEA representative under Article 27 is required only where the territorial and exemption conditions call for one; a non-EEA controller cannot present this EU-based draft as evidence of establishment.

Review this policy at least annually and before a material change in processing. Publish the revision date, retain previous versions, and notify affected clients directly where appropriate. Obtain new consent before a new consent-dependent purpose; do not use an amendment clause to create retroactive permission.

Proposed EU policy version 0.2 — 17 October 2026. The retention, security, human-review, marketing, and EEA-hosting provisions are explicit proposed operating choices, not verified implementation. Before launch, confirm the actual controller/member state, working privacy contact, DPO/representative assessment, vendors and access countries, national legal duties, final retention schedule, and deployed cookie controls.

Changing the fictional company name alone is insufficient to make this notice accurate. The final text must match the real service. Read the Terms of Engagement for the separate investment relationship.