1. Who We Are
This Privacy Policy explains how Thamra SPC ("Thamra," "we," "us") collects, uses and protects your personal data. Thamra SPC is an exempted segregated portfolio company incorporated in the Cayman Islands, registration number 440184, with its registered office at c/o Avroe Management Ltd., George Town Financial Center, Suite 306, 90 Fort Street, PO Box 10061, George Town, Grand Cayman, KY1-1001, Cayman Islands.
Thamra SPC is the data controller for your personal data. This policy covers the Thamra mobile application, website and all related services (the "Platform"). Thamra is not licensed or regulated by any financial regulator, as explained in our Terms of Service.
2. Legal Framework
Our handling of personal data is governed by:
- the Data Protection Act (As Revised) of the Cayman Islands;
- the Proceeds of Crime Act and the Anti Money Laundering Regulations (As Revised) of the Cayman Islands;
- FATCA and the OECD Common Reporting Standard (CRS), as implemented in the Cayman Islands; and
- where they apply to you, the data protection laws of your country of residence, such as the EU General Data Protection Regulation for residents of the European Union.
3. Information We Collect
Identity information: full name, date of birth, nationality, gender, residential address, photograph and selfie for liveness checks, and the details and image of your Identity Document (passport or national identity card), together with proof of address.
Contact information: email address and mobile phone number, both verified by one time passcode.
Financial information: source of funds and source of wealth declarations, employment details, income range, and the details of the bank account in your name (including IBAN).
Investor information: your confirmation of investment knowledge and capacity to bear losses, and any supporting information you provide.
Tax information: country or countries of tax residence, Taxpayer Identification Number(s), US Person status, and US TIN if applicable.
Invitation information: who invited you and whom you invite.
Investment information: transaction history, Wallet balance, holdings and distribution records.
Technical information: device type, operating system, IP address, approximate location derived from your IP address, app usage patterns and crash logs.
4. How We Use Your Information
| Purpose | Legal basis |
|---|
| Identity verification and KYC | Legal obligation under Cayman anti money laundering law |
| Checking your eligibility and managing invitations | Performance of our contract with you |
| Processing investments, distributions and withdrawals | Performance of our contract with you |
| Anti money laundering, counter terrorism financing and sanctions screening | Legal obligation |
| FATCA and CRS tax reporting | Legal obligation |
| Improving Platform functionality, security and fraud prevention | Our legitimate interests |
| Marketing communications | Your consent, which you may withdraw at any time |
5. Who We Share Your Information With
We share your information only as needed for the purposes above, with:
- FACEKI, our identity verification provider, for KYC and liveness checks;
- our payment provider and banks, for payments, withdrawals and account verification;
- Product Managers and administrators of Underlying Products, where they need investor records to process subscriptions, redemptions and distributions;
- the security trustee and the corporate services provider of Thamra SPC, for the administration of the Segregated Portfolios;
- the Cayman Islands Tax Information Authority, for annual FATCA and CRS reporting, which may be exchanged with foreign tax authorities including the US Internal Revenue Service;
- the Cayman Islands Financial Reporting Authority and other competent authorities, for suspicious activity reports or where required by law;
- our cloud hosting provider, for encrypted data storage; and
- auditors and professional advisers, for audits and legal compliance.
We do not sell your personal data. We do not share your data for marketing purposes without your consent.
6. International Transfers
Our service providers may process your data outside the Cayman Islands and outside your country of residence. When we transfer data internationally, we use contractual safeguards that require the recipient to protect it to a standard consistent with Cayman Islands data protection law and, where applicable, the law of your country of residence.
7. Data Retention
| Data | Retention period |
|---|
| KYC and identity documents | 5 years after account closure |
| Transaction records | 5 years after the transaction or account closure, whichever is later |
| AML screening and suspicious activity records | 5 years after account closure |
| FATCA and CRS self certifications and reports | 6 years after the end of the year to which they relate |
| Marketing preferences and analytics data | Deleted on request or at account closure |
We may keep data longer where required by law, by a competent authority, or for the defence of legal claims.
8. Account Deletion
When you request account deletion, we immediately disable your access. Non regulated data, including login credentials, app preferences and marketing data, is deleted within 30 days. Regulated data, including identity documents, transaction records and KYC information, is moved to a secure archive with restricted access and kept for the periods in Section 7. After the retention period, all archived data is permanently deleted.
When you start deletion in the app, you will see this message:
"We'll delete your login, preferences and app data. Anti money laundering and tax laws require us to keep identity documents and transaction records in a secure archive for at least 5 years."
9. Your Rights
You may request access to your personal data, correction of inaccuracies, deletion of your data (subject to legal retention obligations), restriction of processing, objection to processing based on our legitimate interests, and portability of your data. You may withdraw your consent to marketing at any time. Contact privacy@thamra.ai.
We will respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Ombudsman of the Cayman Islands, which supervises data protection, or to the data protection authority in your country of residence.
10. Security
We use industry standard technical and organisational measures to protect your personal data, including encryption of data in transit and at rest, secure credential storage, access controls and session management. Our security practices are reviewed regularly, including through independent security assessments. For questions about our security measures, contact privacy@thamra.ai.
11. Age Restriction
Thamra is not intended for anyone under 21 years old. We do not knowingly collect personal data from individuals under 21.
12. Changes to This Policy
We will notify you of material changes by email and in app notification. Your continued use of Thamra after notification constitutes acceptance.
13. Contact
For privacy enquiries: privacy@thamra.ai
Thamra SPC, c/o Avroe Management Ltd., George Town Financial Center, Suite 306, 90 Fort Street, PO Box 10061, George Town, Grand Cayman, KY1-1001, Cayman Islands