UniCap Securities Limited

1. INTRODUCTION

At UniCap Securities Limited ("UCSL", the "Company", "we", "us" or "our"), the privacy of our website visitors, Clients and Users is one of our priorities. This Privacy Policy explains what personal information we collect, why we collect it, how we use, disclose, store and protect it, and the choices and rights available to you.

This Privacy Policy applies to personal information collected through our website www.unicap-securities.com, our digital and online trading platforms, our mobile applications, and in connection with the account-opening, brokerage, depository, margin financing, IPO and other capital-market services described in our Terms & Conditions (together, the "Services").

Where you also interact with us offline — for example, by submitting a physical account-opening form, visiting our office, or communicating by phone — this Privacy Policy applies equally to the personal information collected through those channels, to the extent it relates to the Services.

This Privacy Policy should be read together with our Terms & Conditions, the applicable client agreement, account-opening documentation, risk disclosure statement, and any other Specific Agreement or notice applicable to a particular service. Where a Specific Agreement, or Applicable Law, is inconsistent with this Privacy Policy, the Specific Agreement or Applicable Law shall prevail to the extent of the inconsistency.

If you have questions about this Privacy Policy or how we handle your personal information, please contact us using the details in Clause 21.

2. DEFINITIONS AND INTERPRETATION

For the purposes of this Privacy Policy, unless the context otherwise requires:

• "Applicable Law" means the Personal Data Protection Ordinance, 2025; the Cyber Security Act, 2023; the Money Laundering Prevention Act, 2012; the Anti-Terrorism Act, 2009; the Bangladesh Securities and Exchange Commission (Stock Dealer, Stock Broker and Authorised Representative) Rules, 2000; the Depositories Act, 1999; and any rule, regulation, directive, order, circular or notification issued thereunder or by BSEC, DSE, CSE, CDBL, Bangladesh Bank, BFIU, the National Data Governance Authority or any other competent authority, in each case as amended, repealed, re-enacted or replaced from time to time;
• "BO Account" means a Beneficiary Owner's securities account maintained with CDBL;
• "Client" means a person or entity that has entered into an account-opening or other Specific Agreement with the Company for the provision of a regulated service;
• "Data Fiduciary" has the meaning given to it under the Personal Data Protection Ordinance, 2025, and refers to the entity that determines the purpose and means of processing personal data. In relation to personal information processed for the Services, UniCap Securities Limited generally acts as the Data Fiduciary;
• "Data Subject" means an identified or identifiable natural person to whom personal data relates, including a Client, User, prospective client, authorised representative or nominee;
• "Personal Data" or "personal information" means any information relating to a Data Subject that identifies, or could reasonably be used to identify, that person, whether directly or indirectly;
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, transfer, restriction, erasure or destruction;
• "Sensitive Personal Data" means personal data revealing biometric information, health information, religious belief, financial account details, or other categories of data treated as sensitive under Applicable Law;
• "Services" and "User" have the meanings given in Clause 1 and the Company's Terms & Conditions;
• "Website" means www.unicap-securities.com and any authorised digital platform, portal or application operated by the Company.

3. SCOPE AND APPLICATION

This Privacy Policy applies to all Clients, Users and other individuals whose personal information UniCap Securities Limited collects or processes in connection with the Services, whether that information is collected through the Website, in person, by phone, by post, by email, or through an authorised intermediary or representative.

This Privacy Policy does not apply to information processed by third parties whom UniCap Securities Limited does not control, including third-party websites linked from the Website (see Clause 16), or to the internal policies of Union Capital Limited or other Company Group entities in respect of their own services, which are governed by their respective privacy notices.

4. CONSENT

By using the Website or applying for or availing of a Service, you consent to the collection, use, disclosure and other processing of your personal information in accordance with this Privacy Policy and Applicable Law.

Where consent is the basis for processing, it will be sought in a voluntary, specific, informed and revocable manner, and you may withdraw consent at any time by contacting us using the details in Clause 21, without affecting the lawfulness of processing carried out before withdrawal.

Certain processing — in particular, KYC, AML/CFT and regulatory-screening processing, and processing necessary for the performance of a Specific Agreement or compliance with Applicable Law — does not depend on consent and may continue notwithstanding withdrawal of consent, to the extent permitted or required by Applicable Law. Where you decline to provide information necessary for a regulated Service, the Company may be unable to open or continue that Service.

5. INFORMATION WE COLLECT

Depending on your relationship with the Company and the Service concerned, we may collect the following categories of personal information:

5.1 Information You Provide Directly

When you contact us, register on the Website, or make an enquiry, you may provide your name, email address, phone number, the contents of your message and any attachments, and any other information you choose to share.

5.2 KYC, Identity Verification and Regulatory Information

When you open or maintain an account or BO Account, we collect information required for identity verification and regulatory compliance, which may include your National ID, passport or other government-issued identification, e-TIN, photograph, signature, nominee details, source-of-fund declarations, occupation and employer information, and other KYC documentation required under Applicable Law.

5.3 Account, Trading and Transaction Information

This includes your BO account and trading account details, order and trade history, portfolio holdings, margin and financing information, bank account details used for settlement, fee and payment records, and correspondence relating to your account.

5.4 Information Collected Automatically

Like most websites and hosting services, UniCap Securities Limited follows a standard practice of using log files. These files log visitors when they access the Website. The information collected by log files may include Internet Protocol (IP) addresses, browser type, Internet Service Provider (ISP), date and time stamps, referring and exit pages, and, where applicable, the number of clicks. This information is not, by itself, used to identify individual visitors; it is used to analyse trends, administer the Website, track aggregate usage patterns and gather demographic information.

5.5 Cookies and Similar Technologies

Like other websites, UniCap Securities Limited uses "cookies" and similar technologies. Further detail on our use of cookies is set out in Clause 14.

5.6 Information from Third Parties and Public Sources

We may receive information about you from CDBL, DSE, CSE, banks, credit bureaus, sanctions and adverse-media screening providers, other financial institutions, publicly available records, and authorised representatives or introducing entities, where necessary for KYC, AML/CFT, credit or regulatory purposes.

6. HOW WE USE YOUR INFORMATION

We may use the personal information we collect for purposes that may include:

• opening, verifying and administering your account and BO Account;
• providing brokerage, depository, margin financing, IPO and other Services you request;
• processing orders, settlements, corporate actions and payments;
• conducting KYC, AML/CFT, sanctions and other regulatory screening and ongoing due diligence;
• communicating with you about your account, transactions, and matters relating to the Services;
• sending research reports, newsletters, market updates and marketing or promotional materials via email, SMS, social media platforms or other channels, subject to Clause 15;
• maintaining the security and integrity of our systems and preventing fraud;
• complying with obligations owed to BSEC, DSE, CSE, CDBL, Bangladesh Bank, BFIU, NBR or another competent authority, or with a court order or lawful request;
• analysing and improving the Website and our Services; and
• any other purpose disclosed to you at the point of collection or to which you have consented.

7. LEGAL BASES FOR PROCESSING

We process personal information on one or more of the following bases, as applicable under Applicable Law:

1. your consent;
2. performance of a Specific Agreement to which you are a party, or steps taken at your request prior to entering into such an agreement;
3. compliance with a legal or regulatory obligation to which the Company is subject, including KYC, AML/CFT, tax and securities-market reporting obligations; and
4. the Company's legitimate business interests, including fraud prevention, network and information security, and the administration of the Website, provided such interests are not overridden by your rights under Applicable Law.

8. DISCLOSURE AND SHARING OF INFORMATION

We do not sell your personal information. We may share personal information in the following circumstances:

8.1 Regulatory and Statutory Authorities

We may disclose personal information to BSEC, DSE, CSE, CDBL, Bangladesh Bank, BFIU, NBR, the National Data Governance Authority, or another competent regulatory, exchange, clearing, settlement, depository, tax or governmental authority, where required or permitted by Applicable Law.

8.2 Service Providers and Company Group

We may share information with third-party service providers who support our operations — including hosting, technology, cybersecurity, communication, payment-related and professional service providers — under contractual confidentiality and security obligations, and with Union Capital Limited and other Company Group entities where necessary for the purposes described in Clause 6, subject to Applicable Law.

8.3 Legal and Law-Enforcement Disclosures

We may disclose personal information where necessary to comply with a court order, legal process, or lawful request from a law-enforcement or governmental authority, to establish or defend legal claims, or to protect the rights, property or safety of the Company, its Clients or others.

9. CROSS-BORDER TRANSFER OF INFORMATION

Where the Company engages a service provider, exchange, correspondent or Company Group entity located outside Bangladesh, or otherwise transfers personal information outside Bangladesh in connection with the Services, such transfer will be carried out in accordance with Applicable Law, including any restriction on the transfer of restricted or confidential categories of data, any requirement that the recipient jurisdiction maintain comparable protection standards, and any consent, contractual safeguard or regulatory approval required under the Personal Data Protection Ordinance, 2025.

10. DATA RETENTION

We retain personal information for as long as necessary to provide the Services, and thereafter for the period required or permitted under Applicable Law, including the record-keeping requirements applicable to KYC, AML/CFT, trading, settlement and depository records under BSEC, CDBL and BFIU requirements, or as necessary to establish, exercise or defend legal claims.

Where you exercise a right of erasure under Clause 12 and no overriding statutory retention obligation applies, we will delete or anonymise your personal information within a reasonable period.

11. DATA SECURITY

The security of your personal information is important to us. We maintain administrative, technical and physical safeguards designed to protect personal information against unauthorised access, disclosure, alteration or destruction, consistent with the Cyber Security Act, 2023 and applicable industry practice.

However, no method of transmission over the internet, and no method of electronic storage, is completely secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

12. YOUR RIGHTS AS A DATA SUBJECT

Subject to Applicable Law and the exceptions described in this Privacy Policy, you may have the right to:

• access the personal information we hold about you, in an understandable format;
• request correction of inaccurate or incomplete personal information;
• withdraw consent to processing that is based on consent;
• request erasure of your personal information, where no overriding legal or regulatory retention obligation applies; and
• object to, or request restriction of, certain processing, where permitted under Applicable Law.

You may exercise these rights by contacting us using the details in Clause 21. We may need to verify your identity before acting on a request, and certain requests may be limited where the information is necessary for regulatory compliance, the performance of a Specific Agreement, or the establishment, exercise or defence of legal claims.

13. CHILDREN'S PRIVACY

The Services are intended for use by persons who meet the eligibility and account-opening requirements under Applicable Law and are not directed to children. We do not knowingly collect personal information from a child, and we do not knowingly engage in profiling, behavioural tracking or targeted advertising directed at children. If we become aware that we have inadvertently collected personal information from a child without appropriate consent, we will take reasonable steps to delete that information.

14. COOKIES AND SIMILAR TECHNOLOGIES

Like most websites, UniCap Securities Limited uses cookies and similar technologies. Cookies are small files that a website transfers to your device's hard drive to store information such as your preferences and the pages you have accessed or visited. This information is used to optimise your experience by customising the Website's content based on your browser type and other information.

Cookies used on the Website may include:

• strictly necessary cookies, required for the Website and secure online trading facilities to function;
• performance and analytics cookies, used to understand how visitors use the Website;
• functionality cookies, used to remember your preferences; and
• where applicable, advertising or marketing cookies, used to deliver relevant content.

You can choose to disable cookies through your individual browser options. More detailed information on how to manage cookie settings for specific web browsers can be found on the respective browsers' websites. Disabling certain cookies may affect the functionality of the Website, including secure online trading facilities.

15. MARKETING COMMUNICATIONS

We may use your contact information to send research reports, newsletters, market updates, and marketing or promotional materials via email, SMS, social media platforms or other channels, where you have consented or where such communication is otherwise permitted under Applicable Law.

You may opt out of marketing communications at any time by following the unsubscribe instructions included in such communications or by contacting us using the details in Clause 21. Opting out of marketing communications does not affect service-related communications, such as trade confirmations, statements and regulatory notices, which we are required or entitled to send you in connection with the Services.

16. THIRD-PARTY WEBSITES AND LINKS

The UniCap Securities Limited Website may contain links to external websites, including websites of regulators, stock exchanges, depositories, government agencies, financial institutions and other third parties. This Privacy Policy does not apply to, and the Company is not responsible for, the privacy practices or content of such third-party websites. We encourage you to review the privacy policies of any third-party website you visit.

17. DATA BREACH NOTIFICATION

In the event of a personal-data breach that is likely to result in significant harm to affected Data Subjects, the Company will take reasonable steps to assess and contain the breach, and will notify the National Data Governance Authority and, where required under Applicable Law, the affected Data Subjects, within the timeframe prescribed by Applicable Law.

18. DATA PROTECTION CONTACT

UniCap Securities Limited has designated a contact point to address queries, requests and concerns relating to the processing of personal information and compliance with this Privacy Policy and Applicable Law, including the Personal Data Protection Ordinance, 2025. You may reach this contact point using the details in Clause 21.

19. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated Privacy Policy on the Website and updating the "Last Updated" date at the top of this document, and, where required by Applicable Law or where the change is material, by providing notice through email or a prominent notice on the Website prior to the change becoming effective.

You are advised to review this Privacy Policy periodically. Continued use of the Website or the Services after a revised Privacy Policy becomes effective constitutes acceptance of the updated Privacy Policy, subject to Applicable Law.

20. GOVERNING LAW

This Privacy Policy shall be governed by and interpreted in accordance with the laws of Bangladesh, including the Personal Data Protection Ordinance, 2025. Nothing in this Privacy Policy shall restrict the statutory powers or jurisdiction of the National Data Governance Authority, BSEC, DSE, CSE, CDBL, Bangladesh Bank, BFIU, NBR or any other competent authority.

21. CONTACT US

If you have any questions, concerns or requests about this Privacy Policy or how we handle your personal information, please contact us:

For data-protection-specific queries or to exercise a right described in Clause 12, please mark your communication "Attn: Data Protection Contact."