Your information, handled with care and discipline.

GTR Global Precious Metals FZCO, Dubai, United Arab Emirates (referred to as “GTR Global”, “we”, “us” or “our”) is responsible for the personal information described in this policy. This policy applies to visitors, prospective counterparties, supplier applicants, approved suppliers, their owners, directors, authorised signatories, team members and other individuals whose information is provided to us.

A supplier business that provides information about another person must ensure it is authorised to do so and that the person has been directed to this policy.

Depending on your relationship with us, we may collect:

• contact details, correspondence and information submitted through website forms;
• account credentials, security events and activity within the supplier platform;
• company records, trade licences, ownership structures and beneficial ownership details;
• names, dates of birth, nationality, residence, identity documents and details of directors, owners and authorised signatories;
• identity-verification information, including passport images, facial images, liveness results and verification decisions where these checks are activated;
• source-of-gold, mine, intermediary, shipment, assay, refinery, insurance, customs and chain-of-custody information;
• banking and settlement details, declarations, signatures and uploaded documents;
• sanctions, politically exposed person, adverse media and other due-diligence results; and
• technical information such as IP address, browser type, device information, login times and security logs.

We generally receive this information directly from you or your organisation. We may also receive information from public registers, compliance and identity-verification providers, refineries, logistics partners, professional advisers and competent authorities.

We process information where necessary to:

• respond to enquiries and assess whether to begin or continue a business relationship;
• create and secure accounts and operate the supplier compliance platform;
• verify identity, authority, ownership, provenance and supply-chain information;
• comply with anti-money-laundering, counter-terrorist financing, sanctions, responsible sourcing, record-keeping and other legal obligations;
• review, approve, hold or decline supplier applications and shipments;
• manage contracts, logistics, assays, delivery and settlement records;
• protect our systems, people, assets and counterparties and prevent fraud;
• establish, exercise or defend legal claims; and
• maintain an auditable record of decisions and access to sensitive evidence.

These activities are based on legal obligations, steps requested before entering a contract, performance of a contract, consent where specifically requested, and our legitimate interests in operating a secure and responsible precious-metals business. We do not sell personal information.

Where required, identity checks may compare a photograph or live facial capture with an identity document and test whether the person is physically present. This may involve biometric information and is performed only with a clear notice and consent where consent is required. A verification provider may process the images and return a result to us.

We also screen relevant people and entities against sanctions, politically exposed person and adverse-media sources. Results inform review by authorised compliance staff; they do not create automatic supplier approval or rejection. We may request more information, place a relationship on hold or make a report where the law requires it.

We may disclose relevant information, on a need-to-know basis, to:

• identity, screening, hosting, storage, security and communications providers;
• banks, refineries, insurers, vaults, logistics operators and other transaction participants where necessary for a proposed or active transaction;
• auditors, legal advisers and other professional advisers bound by confidentiality;
• members of the Goldtree Reserve group where necessary for legitimate group operations;
• courts, regulators, law-enforcement bodies and other competent authorities when required or permitted by law; and
• a buyer or successor in connection with a genuine corporate reorganisation or sale.

Service providers may use information only to provide their contracted service and must apply appropriate confidentiality and security safeguards.

Precious-metals transactions and their supporting services are international. Your information may therefore be processed outside the UAE, including in countries whose data-protection rules differ from those in the UAE. Where required, we use contractual protections, recognised transfer mechanisms or another lawful safeguard and limit the information transferred to what is necessary.

We keep information for as long as needed for the purpose for which it was collected. Compliance, transaction, identity and supplier records are ordinarily retained for at least five years after the business relationship or relevant transaction ends, and longer where law, a regulator, an investigation, a dispute or a legal hold requires it.

Unsuccessful enquiries and incomplete applications are reviewed periodically and deleted or anonymised when they are no longer required, subject to our legal and fraud- prevention obligations. Audit records may be retained separately to preserve the integrity of our compliance history.

We use access controls, encryption, private document storage, multi-factor authentication for staff, activity logging and role-based permissions to protect information. Sensitive identity evidence is restricted to authorised compliance personnel, and access is recorded. No online system is entirely risk-free, but we maintain safeguards proportionate to the sensitivity of the information we hold.

You are responsible for keeping your sign-in details confidential, using a unique password and promptly telling us if you suspect unauthorised account access.

Our website and platform use essential cookies and similar storage needed to keep you signed in, maintain security, remember your session and operate the service. These cannot be switched off through our service. If we introduce non-essential analytics or advertising cookies, we will provide an appropriate choice before using them where the law requires it.

Subject to applicable law, you may ask us to confirm whether we process your personal information, provide access to it, correct inaccurate information, restrict or stop certain processing, erase information, or provide portable information. You may also withdraw consent where processing depends on consent and raise a concern about how your information is handled.

Some rights are limited where we must retain or process information to meet anti-money- laundering, sanctions, regulatory, legal-claims or security obligations. We may need to verify your identity before responding. You may also complain to the competent UAE data protection authority where applicable.

For a privacy question, request or complaint, email info@gtr-global.com. Please use “Privacy request” in the subject line and do not email passport copies or other sensitive identity documents. We may update this policy when our services or legal obligations change; the effective date above shows the latest revision.