Privacy policy
for the CWS brand ecosystem

As of 1 December 2025

1. Preamble and scope
   This privacy policy describes how personal data is processed within the CWS brand ecosystem. It applies worldwide to all digital and analogue offerings of the companies and brands listed below, regardless of the country from which you use our services.

1.1 Company responsible for operations

Conquistador World System FZCO

DSO-IFZA, IFZA Properties Buildings, Dubai Silicon Oasis, Dubai
Trade License number : 74380 dated 20.11.2025

Email: conquistaworldsystem@gmail.com

1.2 Scope of application by region
We comply with the applicable data protection laws, in particular:

• the General Data Protection Regulation of the European Union,
• Swiss data protection law, in particular the revised Federal Act on Data Protection,
• the data protection law of the United Kingdom of Great Britain and Northern Ireland,
• the Personal Data (Privacy) Ordinance of the Hong Kong Special Administrative Region of the People’s Republic of China,
• the data protection law of the United Arab Emirates, in particular Federal Decree-Law No. 45 of 2021 on the protection of personal data,
• the Law of Ukraine on the Protection of Personal Data,
• and other national data protection regulations, insofar as they apply to the use of CWS services.

This privacy policy is globally oriented. In individual countries, supplementary local privacy notices and special provisions may apply.

2. Responsible body, joint responsibility and data protection contact

2.1 Responsible body within the meaning of the European Union’s General Data Protection Regulation

For users from the European Union and the European Economic Area, as well as for processing related to the European Union, the following company is jointly responsible alongside Conquistador World System FZCO:

 

Conquistador World System FZCO

DSO-IFZA, IFZA Properties Buildings, Dubai Silicon Oasis, Dubai
Trade License number : 74380 dated 20.11.2025

Email: conquistaworldsystem@gmail.com

 

2.2 Data protection officer and central data protection contact point
Regardless of your country of residence, you can contact our central data protection contact point for all data protection issues:

Data Protection Officer for the SCANDIC Brand Ecosystem
Conquistador World System FZCO

DSO-IFZA, IFZA Properties Buildings, Dubai Silicon Oasis, Dubai
Trade License number : 74380 dated 20.11.2025

Email: conquistaworldsystem@gmail.com

 

3. Terms
   Terms such as “personal data”, “processing”, “controller”, “processor” or “profiling” are used in accordance with the definitions in the European Union’s General Data Protection Regulation. In other jurisdictions, we refer to comparable legal terms.
4. Categories of personal data
   Depending on the service, contract type and interaction, we process the following categories of personal data in particular:

4.1 Master data

• Surname, first name, title (if applicable),
• Residential or business address,
• e-mail address, telephone numbers, preferred language of communication,
• nationality, date of birth, place of birth, if required for identification purposes.

4.2 Contract and financial data

• Contract numbers, customer numbers, account details,
• Information about the products and services you use, in particular in the areas of financial services, payment services, fiduciary services, structuring services, real estate and lifestyle services, health services, data and infrastructure services, and investment and token services,
• Transaction data, e.g. payments, transfers, card transactions, cryptographic wallet addresses, reference numbers,
• billing data, invoices and payment histories,
• Creditworthiness, risk and rating information, to the extent permitted by law and necessary for the respective purposes.

4.3 Data for identification, compliance and money laundering prevention

• Copies of identity documents, e.g. passport or identity card,
• Proof of residence or address, e.g. utility bills
• information on the beneficial owner,
• Information on status as a politically exposed person and results of checks against sanctions lists,
• Information on the origin of assets and funds as well as professional activity,
• Documentation of identification procedures, for example video identification procedures or comparable procedures.

4.4 Usage data and device data in the context of online services

• Internet Protocol address, date and time of access,
• device type, operating system, browser type, language settings,
• log files to ensure system and information security,
• usage profiles relating to our platforms, e.g. pages visited, click paths and session IDs, insofar as this is legally permissible and, where applicable, based on your consent.

4.5 Communication and content data

• Contents of contact enquiries by e-mail, contact form, letter or telephone,
• support and complaint requests,
• uploaded documents and attachments,
• Data provided in feedback, surveys or competitions.

4.6 Marketing and preference data

• Information about subscribed newsletters and consent logs,
• preferred topics, languages and communication channels,
• information about the effectiveness of campaigns, to the extent permitted by law and, where applicable, based on your consent.

4.7 Applicant data and business partner data

• Application documents, in particular CVs, certificates, letters of motivation and references,
• information about contact persons at business partners, compliance documents, contract contents and bank details.

As a rule, we do not process special categories of personal data such as health data, unless this is necessary for certain services, in particular in the health sector, is legally permissible and has been specifically explained to you.

5. Purposes of data processing
   We process personal data for the following purposes:

1. Contractual purposes and pre-contractual measures
   • Supporting interested parties, customers and clients
   • Initiating, concluding and executing contracts within the scope of CWS services, in particular in the areas of banking services, payment services, card services, trust services, corporate and structuring services, real estate and lifestyle services, health services, data and infrastructure services, and investment and token services.
2. Fulfilment of legal obligations
   • Compliance with regulations on the prevention of money laundering and terrorist financing
   • Compliance with identification requirements for customers and business partners
   • Compliance with tax and commercial law retention obligations,
   • Fulfilment of reporting obligations to supervisory authorities, financial investigation agencies and other government agencies.
3. Technical operation, security and stability
   • Operation and monitoring of our IT systems, platforms and databases,
   • Detection and prevention of misuse, fraud, cyber attacks and other security risks,
   • Ensuring the availability, integrity and performance of our services.
4. Communication and customer support
   • Responding to enquiries and complaints,
   • customer care, relationship management and support in regulatory matters,
   • Communication within the framework of existing and initiated contractual relationships.
5. Marketing, analysis and further development of products
   • Sending information about markets, products and services, where legally permissible
   • Conducting customer satisfaction surveys,
   • Analysis of the use of our offerings to improve functionality, security and user-friendliness,
   • Personalisation of content, where legally permissible and, where applicable, covered by your consent.
6. Enforcement and defence of legal claims
   • Asserting, exercising or defending legal claims,
   • Conducting out-of-court and court proceedings,
   • internal compliance and investigation processes.

6. Legal bases for processing
   Depending on the applicable legal system and processing operation, the processing of personal data is based in particular on the following legal bases:

6.1 Within the European Union and the European Economic Area

• Consent pursuant to Article 6(1)(a) of the General Data Protection Regulation
  for example, for sending newsletters, using certain cookies or using analysis tools,
• Contract performance and pre-contractual measures pursuant to Article 6(1)(b) of the General Data Protection Regulation
  for example, for the initiation and execution of banking, payment, trust, card or investment contracts,
• Compliance with legal obligations pursuant to Article 6(1)(c) of the General Data Protection Regulation
  for example, tax obligations, money laundering documentation obligations,
• Safeguarding legitimate interests pursuant to Article 6(1)(f) of the General Data Protection Regulation
  for example, to ensure information security, prevent fraud, for internal administrative purposes or for direct marketing within the legally permissible framework.

Insofar as special categories of personal data are processed, this is only done under the conditions of Article 9 of the General Data Protection Regulation, for example, with your express consent or for health care purposes and in compliance with additional national regulations.

6.2 Switzerland, United Kingdom, Hong Kong, United Arab Emirates, Ukraine and other countries
In other jurisdictions, we base the processing of personal data on comparable grounds:

• fulfilment of a contract or implementation of pre-contractual measures,
• consent,
• fulfilment of legal obligations,
• safeguarding legitimate interests, for example to ensure security, prevent fraud or for internal administration.

7. Origin of the data
   We obtain personal data from the following sources in particular:

• directly from you when you register, enter into a contract, make enquiries or undergo identification procedures;
• from business partners, correspondent banks, payment service providers and intermediaries,
• from public registers and databases, such as commercial registers, sanctions lists or company registers,
• from credit agencies and service providers that carry out checks for money laundering prevention, creditworthiness or sanctions lists, to the extent permitted by law,
• from the use of our websites, applications and platforms, in particular through log files and usage analyses.

8. Recipients and categories of recipients of personal data
   We transfer personal data exclusively within the scope of what is legally permissible to the following categories of recipients:

• Companies in the CWS brand ecosystem and its affiliated companies,
• service providers in the context of order processing, in particular providers of IT hosting, cloud services, identification services, payment processing, printing and shipping services, communication and support systems,
• Financial institutions, payment service providers, card organisations and service providers in the field of cryptographic assets, insofar as this is necessary for the fulfilment of the contract,
• Consultants, in particular auditing firms, law firms, tax advisors and compliance consultants,
• Government authorities, supervisory authorities, financial investigation agencies and law enforcement agencies, insofar as we are legally obliged to do so or such transfer is necessary to protect our rights,
• Cooperation and distribution partners, insofar as this is necessary for the fulfilment of the contract or is based on your consent.

Contracts are concluded between us and service providers who process personal data on our behalf, which in particular ensure the protection of your personal data.

9. International data transfers
   As a globally active financial, fiduciary and service ecosystem, we also transfer personal data to countries outside the European Union and the European Economic Area, in particular to:

• Hong Kong, Special Administrative Region of the People’s Republic of China,
• the United Arab Emirates,
• the Swiss Confederation,
• the United Kingdom of Great Britain and Northern Ireland,
• Ukraine,
• and, where applicable, other countries in which cooperation partners or service providers are based.

Insofar as these transfers relate to data subjects within the European Union and the European Economic Area, we ensure an adequate level of protection for personal data. This is achieved, for example, through:

• Adequacy decisions by the European Commission,
• the conclusion of standard contractual clauses,
• additional technical and organisational protective measures such as encryption, pseudonymisation and strict access regulations.

Information on specific guarantees for certain data transfers is available on request.

10. Storage period and deletion
    We only store personal data for as long as is necessary to fulfil the aforementioned purposes or as we are legally obliged to do so.

The storage period depends in particular on:

• statutory retention periods, in particular commercial and tax law provisions,
• special legal regulations on money laundering prevention and financial market supervision,
• contractual limitation periods and the need to assert or defend legal claims.

Once the purpose of processing has ceased to apply, personal data is deleted or anonymised. If deletion is not possible for legal or technical reasons, processing is limited to the necessary extent.

11. Use of our websites and online services
    11.1 Server log files
    When you visit our websites, information is automatically stored in server log files, in particular:

• Internet protocol address,
• date and time of access,
• page or file accessed,
• amount of data transferred,
• referring internet address,
• browser and operating system used.

This processing is based on our legitimate interest in the stability, security and technical optimisation of our websites and platforms.

11.2 Cookies and similar technologies
Our websites and platforms use cookies and similar technologies to:

• provide basic technical functions, such as session management and language selection,
• analyse usage and improve our offerings,
• support marketing and remarketing measures, where legally permissible and based on your consent, where applicable.

In particular, we distinguish between:

• technically necessary cookies, which are required for the operation of the website,
• convenience and preference cookies, for example for language selection and display settings,
• analysis and performance cookies,
• marketing and tracking cookies.

You can adjust your cookie settings via the cookie banner provided or a preference centre and deactivate unnecessary cookies at any time.

11.3 Web analytics and marketing tools
Depending on the website and service, analysis tools and marketing tools may be used. These tools are used, for example, to measure reach, evaluate user behaviour and optimise content.

Insofar as these tools process personal data or access information on end devices, this is done on the basis of:

• your consent, or
• our legitimate interest in analysing and improving our offerings, provided this is permissible under data protection law.

Details on individual tools can be found in separate notices on the respective websites, if applicable.

12. Special processing in financial, fiduciary and payment services

12.1 Identification, money laundering prevention and sanctions checks

Within the scope of the services provided by CWS and comparable services, we are legally obliged to carry out comprehensive checks to prevent money laundering and terrorist financing. This includes in particular:

• the identification of customers and beneficial owners,
• checks against sanctions lists,
• classifying customers according to risk criteria,
• monitoring transactions to detect unusual or suspicious activities,
• documenting these processes and reporting suspicious circumstances to the competent authorities.

The legal basis for this is provided by the laws applicable in the respective countries for the prevention of money laundering and terrorist financing, as well as regulations issued by the financial supervisory authorities.

12.2 Profiling and automated decisions in individual cases

For risk assessment, fraud prevention and compliance with legal requirements, we may carry out automated assessments, for example:

• classifying customer relationships into risk or product categories,
• automated verification rules for detecting unusual transactions,
• internal warning or verification functions.

Fully automated decisions with legal effect, for example the fully automated rejection of a contract without human review, are only made if this is legally permissible and appropriate measures are in place to protect your rights. In such cases, you have the right to request a human review of the decision and to state your position.

13. Minors
    Most of our services are aimed at adults. Persons who have not yet reached the age of majority in their country of residence may only use our financial, payment or investment services if the applicable legal requirements are met and, where applicable, the consent of their legal representatives has been obtained.

If we discover that personal data of minors has been processed without the required consent, we will take appropriate measures to delete this data, provided that there are no legal retention obligations to the contrary.

14. Data security
    We take extensive technical and organisational measures to protect personal data from loss, misuse, unauthorised access and unauthorised disclosure. These include, in particular:

• Encryption of data transmissions,
• role-based access rights and authentication procedures,
• firewalls and systems for detecting and preventing attacks,
• logging and monitoring of security-related events,
• regular updating of the software and infrastructure used,
• raising awareness and training our employees.

15. Obligation to provide personal data
    In many cases, particularly for financial, payment and trust services, we are legally obliged to collect certain personal data. Without this data, we cannot:

• open accounts,
• process transactions,
• manage assets,
• or provide certain services.

Where possible, we indicate in forms or processes which information is required and which is optional.

16. Your rights as a data subject
    Depending on the applicable data protection law, you have various rights regarding your personal data.

Within the European Union and the European Economic Area, these include in particular:

• Right to information about the personal data processed
• Right to rectification of inaccurate data
• Right to erasure of personal data, provided that there are no legal retention obligations to the contrary,
• Right to restriction of processing,
• the right to transfer your data in a structured, commonly used and machine-readable format,
• Right to object to certain processing, in particular direct marketing or processing based on legitimate interests,
• Right to withdraw consent with effect for the future.

In Hong Kong, the Swiss Confederation, the United Kingdom of Great Britain and Northern Ireland, the United Arab Emirates, Ukraine and other countries, there are functionally comparable rights, the specific form of which varies depending on the legal system.

16.1 Exercising your rights
To exercise your rights, you can contact our data protection contact point at any time:
Conquistador World System FZCO

DSO-IFZA, IFZA Properties Buildings, Dubai Silicon Oasis, Dubai
Trade License number : 74380 dated 20.11.2025

Email: conquistaworldsystem@gmail.com

Please describe your request as specifically as possible and, if possible, indicate the brand and country with which you have a business relationship. In individual cases, it may be necessary to request additional information to confirm your identity in order to protect information from unauthorised acces

17. Communication, newsletters and direct marketing
    If you provide us with your contact details, we will use them:

• to respond to your enquiries,
• to send you information in connection with existing or initiated contracts,
• to fulfil legal information obligations,
• to send you information about products and services, insofar as this is legally permissible.

18. Newsletter
    If you expressly consent, we will send you regular newsletters or similar information. In this context:

• we will document your consent with the date and other relevant information,
• you can unsubscribe from the newsletter at any time via an unsubscribe link or by sending us a message,
• revocation of consent has no influence on the legality of the processing carried out up to the point of revocation.

19. Presence on social networks and external platforms
    Our brands and companies maintain presences on social networks and external platforms. When visiting these presences, the following also applies:

• the terms of use and data protection guidelines of the respective platform operator,
• where applicable, joint responsibility between us and the operator for certain processing operations, such as statistical evaluations.

We process data from these presences in order to communicate with you, present our offers and analyse our reach. This may involve data processing in countries outside the European Union and the European Economic Area.

20. Changes to this privacy policy
    We reserve the right to amend this privacy policy at any time with future effect, in particular:

• in the event of changes to legal requirements,
• in the event of extensions or adjustments to our services,
• in the event of organisational changes within the CWS brand ecosystem.

The current version is usually published on the official websites of: Conquistador World System FZCO

DSO-IFZA, IFZA Properties Buildings, Dubai Silicon Oasis, Dubai
Trade License number : 74380 dated 20.11.2025

Email: conquistaworldsystem@gmail.com

We will announce any significant changes that significantly affect your rights separately, for example by posting a notice on our websites or by email.

21. Contact

General data protection enquiries for the CWS brand ecosystem:
Conquistador World System FZCO

DSO-IFZA, IFZA Properties Buildings, Dubai Silicon Oasis, Dubai
Trade License number : 74380 dated 20.11.2025

Email: conquistaworldsystem@gmail.com

 

Central data protection contact point and data protection officer:
Conquistador World System FZCO

DSO-IFZA, IFZA Properties Buildings, Dubai Silicon Oasis, Dubai
Trade License number : 74380 dated 20.11.2025

Email: conquistaworldsystem@gmail.com

 

When making enquiries, please indicate which CWS brand you are associated with and in which country you are based. This will facilitate the rapid and targeted processing of your data protection concerns.

Written, signed and approved:

The Board of Directors of CWS

Dubai, 1 December 2025