Privacy Policy

Effective Date: 30/09/2024

1. Introduction

GoldKach Ltd ("GoldKach", "we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

GoldKach LLP is registered with Companies House, registration number OC422620, with registered address at 124 City Road, EC1V 2NX, London, UK. GoldKach Uganda Limited is registered with registration number 80020003642777, with registered address at 3rd Floor Kanjokya House, Plot 90 Kanjokya Street, Kampala, Uganda.

This policy applies to all personal data collected through our website, mobile applications, and any other digital or physical channels through which we interact with you. By using our services, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of your information in accordance with it.

2. Information We Collect

We may collect and process the following categories of personal data about you:

Identity and Contact Data

  • Full name, title, date of birth, and gender
  • Email address, telephone number, and postal address
  • National identification number, passport number, or other government-issued identification
  • Tax identification number and residency status

Financial Data

  • Bank account details, payment card information, and transaction history
  • Investment portfolio details, risk appetite, and financial objectives
  • Source of funds, income information, and net worth declarations

Technical and Usage Data

  • IP address, browser type and version, time zone setting, and browser plug-in types
  • Operating system and platform, device identifiers
  • Pages visited, links clicked, and features used on our platform
  • Referral URLs and search terms used to find our website

3. How We Use Your Information

We use the personal data we collect for the following purposes:

  • To provide, maintain, and improve our financial services and products
  • To process transactions and send related information, including confirmations and invoices
  • To verify your identity and conduct anti-money laundering (AML) and Know Your Customer (KYC) checks as required by applicable law
  • To communicate with you about your account, respond to enquiries, and provide customer support
  • To send you marketing communications about our products and services where you have consented or where we have a legitimate interest to do so
  • To comply with our legal and regulatory obligations under UK, Ugandan, and Kenyan financial services law
  • To detect, investigate, and prevent fraudulent transactions and other illegal activities
  • To personalise your experience and deliver content and product offerings relevant to your interests

4. Legal Basis for Processing

We will only process your personal data where we have a lawful basis to do so. The legal bases we rely upon include:

  • Contract performance: Processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract
  • Legal obligation: Processing is necessary for compliance with a legal obligation to which GoldKach is subject, including regulatory requirements under the Financial Conduct Authority (FCA) and the Capital Markets Authority of Uganda (CMAU)
  • Legitimate interests: Processing is necessary for the purposes of our legitimate interests, such as fraud prevention, network security, and improving our services, provided these interests are not overridden by your rights
  • Consent: Where you have given us explicit consent to process your data for a specific purpose, such as receiving marketing communications

5. How We Share Your Data

We do not sell, trade, or rent your personal data to third parties. However, we may share your information with the following categories of recipients in the circumstances described below:

  • Service providers and data processors: Third-party companies that provide services on our behalf, such as IT infrastructure, payment processing, identity verification, and customer communications. These parties are contractually bound to process data only on our instructions and in accordance with applicable data protection law.
  • Regulatory and law enforcement authorities: Where required by law, court order, or regulatory authority, including the FCA, CMAU, HMRC, and the Uganda Revenue Authority.
  • Professional advisers: Lawyers, auditors, accountants, and insurers who provide professional services to GoldKach, subject to confidentiality obligations.
  • Business transfers: In the event of a merger, acquisition, or sale of all or part of our business, your data may be transferred to the relevant third party, subject to appropriate safeguards.

Where we transfer your personal data outside the United Kingdom or the European Economic Area, we ensure that appropriate safeguards are in place, such as standard contractual clauses approved by the UK Information Commissioner's Office (ICO).

6. Retention of Information

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

In determining the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process the data, and whether we can achieve those purposes through other means.

As a regulated financial services firm, we are required to retain certain records for a minimum of five (5) years following the end of a client relationship, and in some cases up to seven (7) years, in accordance with FCA rules and Ugandan financial regulations. After the applicable retention period, we will securely delete or anonymise your personal data.

7. Security

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

  • Encryption of data in transit using TLS/SSL protocols and at rest using AES-256 encryption
  • Multi-factor authentication for access to systems containing personal data
  • Regular security assessments, penetration testing, and vulnerability scanning
  • Staff training on data protection and information security best practices
  • Access controls ensuring that personal data is accessible only to authorised personnel on a need-to-know basis

While we strive to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, and you transmit data to us at your own risk. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by law.

8. Your Data Protection Rights

Under applicable data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the following rights in relation to your personal data:

  • Right of access: You have the right to request a copy of the personal data we hold about you (a Subject Access Request).
  • Right to rectification: You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
  • Right to erasure: You have the right to request that we delete your personal data in certain circumstances, such as where it is no longer necessary for the purposes for which it was collected.
  • Right to restrict processing: You have the right to request that we restrict the processing of your personal data in certain circumstances.
  • Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
  • Right to object: You have the right to object to the processing of your personal data where we rely on legitimate interests as our legal basis.
  • Rights related to automated decision-making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects.

To exercise any of these rights, please contact us using the details provided in the Contact Us section below. We will respond to your request within one month. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at www.ico.org.uk or the relevant data protection authority in your jurisdiction.

9. Cookies

Our website uses cookies and similar tracking technologies to distinguish you from other users, improve your browsing experience, and help us understand how our website is being used. Cookies are small text files that are placed on your device when you visit our website.

We use strictly necessary cookies to enable core website functionality, performance cookies to analyse how visitors use our site, functional cookies to remember your preferences, and targeting cookies to deliver relevant advertising. For full details of the cookies we use and how to manage your cookie preferences, please refer to our Cookie Policy.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated policy on our website with a revised effective date, and where appropriate, by sending you a direct notification.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of our services after any changes to this policy constitutes your acceptance of the updated terms.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we handle your personal data, please contact our Data Protection Officer:

Back To Home