Thamani Privacy Notice

1.1 Your personal information deserves the same care as your money, so here is exactly what happens to it when you use Thamani: our website, platform, app, and everything built on top of them. 1.2 This notice explains what we collect, why, how we share it, and the choices and rights you have over it. We have tried to write it in plain language rather than legal wallpaper, so you can actually understand it. 1.3 Read this alongside our Terms of Use and any Product Terms, Risk Disclosures, Investment Agreements, or other documents that apply to the specific product you are using. 1.4 By using the Thamani Platform, submitting information to us, creating an account, applying for funding, or taking part in a Thamani product, you are confirming you have read this notice. Where we need your separate consent for something specific, we will ask for it separately; this notice does not do that job on its own.

2.1 Thamani Invest Limited, Registration Number 6938730, a company registered under the laws of the Federal Republic of Nigeria, is responsible for the personal information we collect and use, except where another organisation is separately responsible for processing it. 2.2 Under Nigerian data protection law, Thamani may act as a Data Controller where we decide why and how your information is processed. We may also use third-party service providers who process information on our behalf as Data Processors.

3.1 What we collect depends on how you use Thamani and which product you are on, as we do not collect every category from every user. 3.2 What you give us directly. This may include: your full name; email address; phone number; residential or business address; date of birth; identification information; account information; financial information; bank or payment details; employment or business information; information about your business; information in documents you submit; information provided during KYC or verification; information provided when applying for SME funding; information provided when taking part in an investment product or trading through FinVest; your communications with us; and anything else you choose to share. Exactly what is required depends on the product.

4.1 If you apply for Business funding through Thamani, we collect what you put in your application, which includes: details about you; your business; its operations; your funding needs; financial position; business history; contact details; supporting documents; and anything else the application asks for. 4.2 Right now, all information submitted through a Business Funding application is stored by Thamani, and internal access is currently limited to the CEO and CTO. 4.3 Where appropriate, we may share your application with selected finance or capital partners for further assessment, and may share the same application with more than one partner where we think that is the right call. Our financial or capital partners, to the extent this applies across Thamani's service offerings, means a bank, financial institution, lender, investment or financing entity, or other appropriately authorised person or entity to whom Thamani may refer a funding request, subject to the nature of the proposed financing and applicable law. 4.4 Under the current arrangement, a partner is not permitted to contact you directly using information we have shared with them. If that arrangement ever changes, we will review this notice and our contractual controls with partners before it does.

5.1 Where you use FinVest, we collect what is needed to open and administer your trading account and to facilitate your Orders, including: identity verification and KYC information; your investment objectives, financial circumstances, and risk tolerance; your depository account details; your Order and transaction history; and account statements and confirmations. 5.2 Acting as your Sub-Broker, we transmit your Orders to our sponsoring Broker/Dealer for execution. In connection with this, your relevant account and transaction information is shared with: • our sponsoring Broker/Dealer, to execute, clear, and settle your Orders; • The applicable depository, to record legal ownership of securities acquired for you; and • the relevant securities exchange, where necessary to process your activity. 5.3 We do not hold your funds or securities in custody. Any funds or securities we receive from or on behalf of you in connection with FinVest are passed to our sponsoring Broker/Dealer within the timeframe required by SEC rules, currently two working days. 5.4 This section should be read together with the Thamani Sub-Broker Terms of Use and the FinVest Product Investment Agreement, which explain the sub-broker relationship, order handling, and custody arrangements in full.

6.1 When you take part in a Thamani product, we collect what is needed to run that product and manage your relationship with us. This includes: identity verification; eligibility checks; investment participation; payment processing; transaction and investment records; communication; account management; compliance checks; fraud prevention; risk management; customer support; and legal or regulatory needs. 6.2 Different products ask for different things; what PropertyVault needs is not the same as what Finvest needs, which is different again from Mudarabah, and this business Funding is different from all of them.

7.1 When you visit or use the Platform, some technical information gets collected automatically. Depending on the technology in place, this can include: your IP address; device information; browser type; operating system; pages visited; time on page; referring sites; general usage patterns; login information; technical logs; security information; and cookie-based data.

8.1 We may use cookies and similar technologies to help the Platform work properly and understand how people use it, including: keeping the Platform secure; remembering your preferences; enabling core functions; understanding usage; improving the Platform; and measuring performance. 8.2 Non-essential cookies, where used, will be managed in line with applicable data protection requirements.

9.1 Providing our services. We use your information to: create and manage your account; give you access to the Platform; process your requests; administer products; process transactions; communicate with you; and provide customer support. 9.2 Processing investments and participation. Where you take part in a Thamani product, we may use your information to: process your participation; maintain investment records; administer payments; communicate product information; provide statements or confirmations; manage withdrawals or exits where applicable; and fulfil our obligations under the relevant agreement. 9.3 For business Funding, we use what you give us to: receive and review your application; check it against relevant criteria; carry out referral or preliminary checks; identify suitable finance or capital partners; share relevant information with selected partners where permitted; and support further assessment. 9.4 Submitting an application does not guarantee funding. A referral check, where carried out, is not a credit assessment, an approval, or a funding commitment.

10.1 Under Nigerian data protection law, we need a lawful basis to process your information. Depending on the situation, this might be: your consent; that processing is necessary to provide a service or fulfil a contract with you; that it is required by law; that it is necessary to protect your vital interests; that it serves a legitimate interest of ours, weighed against your rights; or another lawful basis recognised under applicable law. 10.2 We will not lean on consent where another basis is genuinely more appropriate. Where we do rely on your consent, you can withdraw it, subject to any legal or contractual consequences, and any processing we are permitted or required to continue regardless.

11.1 We do not sell your personal information. We do share it where necessary to: provide our services; run a product; comply with the law; or carry out a transaction. This can mean sharing with this selected finance or capital partners, investment or operating partners, our sponsoring Broker/Dealer, CSCS or other depository providers, technology service providers, payment providers, professional advisers, auditors, custodians or other service providers where applicable, regulators and government authorities, law enforcement where legally required, fraud prevention or risk management providers, other parties in a given transaction, and third parties where you have given the appropriate consent. 11.2 We only share what is relevant to the purpose it's being shared for.

12.1 Some Thamani products involve third-party businesses such as investment partners, finance houses, property developers, agricultural businesses, technology companies, our sponsoring Broker/Dealer, and others. 12.2 Where your information needs to go to a partner, the applicable product information or consent process will explain that. 12.3 For business Funding specifically: your application may go to selected finance or capital partners for further assessment, and we may share the same application with more than one relevant partner where appropriate. 12.4 Right now, based on what our operations team has confirmed, a partner is not permitted to contact an business applicant directly. We maintain contractual arrangements with partners receiving personal information requiring them to handle it in line with applicable data protection requirements.

13.1 If you give us personal information belonging to someone else, such as a director, employee, business partner, beneficiary, or authorised representative, please only do so where you are authorised to, and where required, make sure that person knows their information may be shared with us.

14.1 Some information needs extra protection under applicable law, such as: • financial information; • identification information; • identity-verification data; and • anything else that could create real risk to you if improperly disclosed. We apply appropriate safeguards to this kind of information, and only collect it where necessary and where we have a lawful basis to do so.

15.1 Because Thamani deals in investments, funding, trading, financial transactions, and business opportunities, we sometimes need to run identity, compliance, and risk-related checks, such as: identity verification; customer due diligence; business verification; sanctions or watchlist checks where applicable; fraud prevention; transaction monitoring where applicable; source-of-funds or source-of-wealth checks where required; and anything else the law, regulation, or our contractual obligations call for. 15.2 Where the law requires us to keep information from these checks, we may keep it even after you stop using the Platform.

16.1 We use personal information to protect your account and the Platform, detect suspicious activity, investigate fraud, prevent unauthorised access, protect users and our business, investigate security incidents, and comply with legal or regulatory requirements, which may involve technical systems and monitoring tools. 16.2 Where a decision is made solely by automated means and has a legal or similarly significant effect on you, the relevant rights and safeguards under data protection law apply.

17.1 We may use technology to help organise applications, identify potentially relevant opportunities, flag unusual activity, run administrative checks, or support risk and compliance processes. That does not necessarily mean decisions about you are made entirely by automated systems. 17.2 Where the law gives you a right to human intervention or other safeguards around solely automated decisions, we will respect that. 17.3 Currently, no Thamani system makes decisions solely by automated means that produce legal or similarly significant effects on you.

18.1 Thamani currently uses Amazon Web Services (AWS) infrastructure, with data stored in AWS's US West (Oregon) data centres. This means personal information collected from users in Nigeria is currently stored outside Nigeria. 18.2 This is an international transfer of personal data, and it needs to be backed by a proper legal mechanism under the NDPA, not just the fact that AWS happens to be a well-known provider. The NDPA specifically regulates cross-border transfers and requires either an adequate level of protection or another recognised lawful basis for the transfer to be valid. 18.3 Where personal information is transferred outside Nigeria, including through our cloud infrastructure provider, we take steps to ensure that transfer is supported by appropriate safeguards in accordance with the NDPA. We are actively reviewing our data transfer arrangements to confirm they meet this standard.

19.1 We take reasonable technical and organisational steps to protect personal information against unauthorised access, disclosure, loss, destruction, alteration, and misuse. 19.2 These measures include access controls and identity management; encryption of data in transit and at rest; network-level protections including a web application firewall; network segmentation isolating sensitive systems; multi-factor authentication for administrative access; ongoing monitoring; secure backups; confidentiality obligations on our personnel and service providers; and an incident management process. We review and update these measures as our systems and the threat landscape evolve.

20.1 We do not keep personal information indefinitely just because you continue to have a relationship with Thamani. We keep it for as long as: • reasonably necessary for the purpose it was collected for; or • we have a legal, regulatory, contractual, accounting, security, or legitimate business reason to hold onto it. 20.2 Exactly how long depends on the type of information and why we collected it; transaction and investment records, for instance, generally need to be kept longer than an unsuccessful enquiry. 20.3 Where information is no longer needed, we will delete, securely dispose of, or anonymise it, subject to legal requirements. 20.4 Business Funding application information is retained on Thamani's systems. 20.5 Permanent retention is not Thamani's general standard. Where a specific law, regulation, or agreement sets a retention period for a category of data, we follow that period. Where none applies, we follow the default position under Nigeria's data protection framework: personal data connected with your general use of the Platform is retained for 3 years after your last active use; and personal data connected with a transaction or contractual relationship, including investment participation and FinVest activity, is retained for 6 years after the last transaction.

Depending on the circumstances and subject to applicable law, you have rights over your personal information, including the right to: 21.1 Be informed: know how and why your information is processed. 21.2 Access your information: ask what we hold about you, and request a copy. 21.3 Correct inaccurate information: ask us to fix anything wrong, incomplete, or outdated. 21.4 Object to certain processing: including some processing based on legitimate interests, or direct marketing. 21.5 Restrict processing: ask us to limit how we use your information in certain circumstances. 21.6 Request deletion: ask us to delete your information where we no longer have a lawful reason to keep it. This is not absolute, as we may need to retain information where the law requires or permits it. 21.7 Data portability: where applicable, receive your information in a structured, commonly used, machine-readable format, or ask that it be transferred elsewhere. 21.8 Withdraw consent: where we rely on your consent, you can withdraw it, though this does not undo processing that already happened or that we are otherwise required to continue. 21.9 Rights around automated decision-making: where applicable. 21.10 Lodge a complaint: you may lodge a complaint with us first, and with the Nigeria Data Protection Commission (NDPC) if you believe your privacy rights have been violated.

22.1 Contact us using: Privacy/Data Protection Email: Help@thamaniinvest.com 22.2 Include, where possible: your name, the email or account associated with your Thamani relationship, the right you want to exercise, and enough detail for us to act on it. 22.3 We may need to verify your identity first, so we do not hand your information to the wrong person.

23.1 Your rights are not unlimited. We may need to retain or keep processing information to comply with a legal or regulatory obligation, establish, exercise, or defend a legal claim, prevent fraud, complete a transaction, protect another person's rights or safety, or for another lawful purpose. 23.2 Where we cannot fully comply with a request, we will explain why, where we are legally permitted to.

24.1 The Platform may link to third-party sites, apps, or services with their own privacy practices. Once you leave Thamani, we are not responsible for how that other organisation handles your information, so check their privacy notice before you share anything with them.

25.1 We use third-party service providers to help run our business and platform, relating to: cloud hosting, technology infrastructure, payment processing, identity verification, our sponsoring Broker/Dealer and CSCS, communications, analytics, security, customer support, professional services, and other functions. 25.2 Where a third party processes information on our behalf, we make sure that is governed by appropriate contractual and data protection terms.

26.1 Some of our service providers or infrastructure sit outside Nigeria; as covered in Section 18, we currently use AWS infrastructure in the United States. 26.2 Where personal information is transferred outside Nigeria, including through service providers such as our cloud infrastructure provider, we take steps to ensure that transfer is supported by appropriate safeguards under Nigerian data protection law, and we'll share more detail about these arrangements where required. The NDPC recognises cross-border transfer as an area needing real protection, and points to mechanisms including adequacy decisions, approved transfer instruments, and other lawful bases under the NDPA. See Section 18 for more on how this applies to our cloud infrastructure specifically.

27.1 Thamani's products are generally meant for people legally able to enter into the relevant agreements and transactions. Unless we say otherwise, our products are not intended for children as defined under the Child Rights Act of 2003; and we do not knowingly collect children's personal information where it is not necessary or legally permitted. If you believe a child has given us personal information improperly, please tell us so we can look into it.

28.1 Where the law allows, we may send you information about Thamani products, services, opportunities, updates, or events. Where consent is required, we will get it first. You can unsubscribe anytime by following the instructions in the message or contacting us, though unsubscribing from marketing does not stop us sending important service, transaction, security, or legal communications.

29.1 We have processes for identifying, assessing, and responding to data breaches and security incidents. Where a breach is likely to pose a risk to your rights, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, in line with the NDPA. 29.2 Where a breach is likely to result in a high risk to you specifically, we will also notify you directly, without undue delay. 29.3 Alongside notification, we will take reasonable steps to contain the breach, assess its impact, protect affected information, and work out how to stop it happening again.

30.1 Protecting your information is not just a legal box to tick; it is part of earning your trust. We aim to: collect only what we need; explain why we need it; use it only for lawful purposes; keep it accurate where it matters; protect it properly; retain it only as long as necessary; control who can access it; work with responsible third-party providers; and respect your rights as a data subject.

31.1 We may update this notice from time to time as our products change, our technology changes, our partners change, the law changes, our data practices evolve, or we improve how we protect your information. 31.2 Where a change is material, we will take reasonable steps to bring it to your attention. The updated version will show when it was last revised.

Questions about this notice, want to exercise a data protection right, or have a concern about how your information's handled? Reach us: • Thamani Invest Limited • Privacy/Data Protection Contact: Help@thamaniinvest.com • Data Protection Contact/DPO: Help@thamaniinvest.com • Email: info@thamaniinvest.com • Address: 21 Covenant Estate, Chief Yesufu Abiodun Road, Oniru, Victoria Island, Lagos State You can also contact the Nigeria Data Protection Commission directly to raise a data protection complaint or seek regulatory assistance.

Your information is part of your relationship with us. We will keep reviewing how we collect, use, store, and protect it as Thamani grows and adds new products and partnerships, because we want you to understand what happens to your information, why we need it, and what control you have over it.