Central Advisors Limited – Privacy Policy

Version: October 2026
Effective date: October 2026

Who we are
What personal data we collect
How we collect your personal data
Why we use your personal data and on what basis
Who we share your personal data with
International transfers
How long we keep your personal data
How we keep your personal data secure
Your rights
Cookies and similar technologies
Changes to this policy
Contact us and complaints

1. Who we are

1.1 This Privacy Policy explains how Central Advisors Limited ("Central Advisors", "we", "us" or "our") collects, uses, shares and protects personal data about people who visit our website at www.central.ky, contact us, book a meeting with us or become our clients.

1.2 Central Advisors Limited is a company incorporated in the Cayman Islands with company registration no. 414822. Our registered office is 10 Market Street, Suite 609, Camana Bay, Grand Cayman KY1-9006, Cayman Islands. Our office address is The White House, 20 Genesis Close, George Town, KY1-1208, Cayman Islands.

1.3 We are licensed by the Cayman Islands Monetary Authority (CIMA) under the Securities Investment Business Act (2020 Revision) as a Securities Advisor and Securities Arranger (licence no. 2219932). We advise on and arrange deals in investments only. We do not hold client money or client assets.

1.4 We provide securities investment advice, arrangement and financial advice on medium to long term investments offered by third parties.

1.5 We are the data controller of the personal data described in this policy under the Cayman Islands Data Protection Act (2021 Revision) (the "DPA"). This means we decide why and how your personal data is used.

1.6 We handle personal data in line with the eight data protection principles in the DPA. In summary, personal data must be:

(a) processed fairly and lawfully;
(b) obtained only for specified, lawful purposes and not used in a way that is incompatible with those purposes;
(c) adequate, relevant and not excessive for those purposes;
(d) accurate and, where necessary, kept up to date;
(e) kept no longer than necessary;
(f) processed in line with your rights under the DPA;
(g) protected by appropriate technical and organisational security measures; and
(h) transferred outside the Cayman Islands only where the destination ensures an adequate level of protection.

1.7 If you give us personal data about another person (for example, a spouse, partner, dependant or beneficiary), please make sure they know you are doing so and refer them to this policy.

1.8 Our website is not aimed at children and we do not knowingly collect personal data from children through it. We may hold limited details of children only where you give them to us as dependants or beneficiaries as part of our advice.

2. What personal data we collect

2.1 Personal data means information that identifies you, directly or indirectly. Depending on how you deal with us, we may collect:

(a) Identity and contact details: your name, date of birth, nationality, home address, email address and telephone number.
(b) Website enquiry details: the information you enter in the calculator details form on our tools page (central.ky/tools) or in our fact-find form (central.ky/fact-find), such as your contact details, age, retirement goals, savings and other answers you choose to give.
(c) Meeting booking details: your name, email address, the time you choose and any notes you add when you book a meeting with us through our online booking tool.
(d) Financial information: for example, your income, savings, pensions, investments, existing policies, financial objectives, attitude to risk, and source of funds and source of wealth.
(e) Identification and verification documents: for example, a copy of your passport or national identity card and proof of address, which we need to meet our anti-money laundering and counter-terrorist financing (AML/CTF) obligations.
(f) Screening results: the results of checks against sanctions, politically exposed person (PEP) and adverse media lists.
(g) Product information: details of the products we arrange for you, including application forms, policy or account numbers and correspondence with product providers.
(h) Marketing preferences: your email address if you subscribe to our email updates, and your choices about receiving marketing from us.
(i) Communications: emails, letters, notes of meetings and calls, and details of any complaints.
(j) Website and technical information: your IP address, browser and device details, the pages you visit and your cookie choices (see Section 10).

2.2 Some information is treated as sensitive personal data under the DPA. Our AML/CTF screening may reveal information about actual or alleged criminal offences, or about whether you hold or have held a prominent public position. We only process sensitive personal data where the DPA allows it, for example where it is needed to meet a legal obligation or where you have given your explicit consent.

2.3 We also collect health information where it is relevant to our financial planning advice, so that our recommendations reflect your needs and circumstances, including your health. Health information is sensitive personal data under the DPA. We use it only for our financial planning advice, and we process it on the basis of your explicit consent, which you give when you provide it to us. We do not share your health information with product providers or insurers. It is kept securely in our own client records and is disclosed to others only where the law requires it. You can withdraw your consent at any time; if you do, we will no longer take your health into account in our advice.

2.4 You do not have to give us your personal data. However, if you do not give us information that we need by law (such as identification documents) or that we need to advise you, we may not be able to act for you.

3. How we collect your personal data

3.1 Directly from you: when you complete a form on our website, subscribe to our email updates, book a meeting, email or call us, meet with us, or send us documents during client onboarding.

3.2 From third parties: from product providers about products we have arranged for you; from our screening provider when we carry out AML/CTF checks; from people you have authorised to act for you or to give us information; and from publicly available sources.

3.3 Automatically: through cookies and similar technologies when you use our website, as described in Section 10.

4. Why we use your personal data and on what basis

4.1 The DPA only allows us to use your personal data where we have a lawful basis. We rely on the following:

(a) Contract: where we need to use your personal data to take steps you ask for before entering into an agreement with us, or to perform our agreement with you.
(b) Legal obligation: where we need to use your personal data to comply with the law, including the Anti-Money Laundering Regulations, the Securities Investment Business Act and other regulatory requirements that apply to us.
(c) Legitimate interests: where we need to use your personal data to run, manage and protect our business, and your interests and rights do not override those interests.
(d) Consent: where you have agreed to a particular use, such as advertising cookies. You can withdraw your consent at any time.

4.2 The main purposes for which we use your personal data, and the basis we rely on for each, are:

Purpose	Lawful basis
To respond to enquiries you send through our website, including calculator and fact-find submissions, and to contact you about them	Steps you ask for before entering into an agreement; legitimate interests
To arrange and hold meetings you book through our online booking tool	Steps you ask for before entering into an agreement; legitimate interests
To understand your circumstances, assess suitability and give you financial advice	Contract; legal obligation
To arrange products with product providers and help you manage them	Contract
To take account of your health in our financial planning advice (health information is not shared with product providers or insurers)	Your explicit consent, given when you provide the information to us (required for sensitive personal data)
To verify your identity, carry out client due diligence and screening, monitor our relationship and report suspicious activity	Legal obligation
To keep the records we are required to keep and to respond to our regulators and other authorities	Legal obligation
To manage our client relationships and administration, including through our CRM and cloud systems	Contract; legitimate interests
To handle complaints and to establish, exercise or defend legal claims	Legal obligation; legitimate interests
To make our website work (essential cookies)	Legitimate interests
To measure and target our Facebook and Instagram advertising (Meta Pixel)	Consent
To send you marketing emails, such as news and updates about our services	Consent (or legitimate interests for existing clients, with an easy opt-out in every email)

4.3 Our screening provider uses automated tools to flag possible matches and risk factors. Decisions about whether we can act for you are made by people, not solely by automated means.

4.4 We will only use your personal data for the purposes for which we collected it, or for a compatible purpose. If we need to use it for a new purpose, we will tell you and, where required, ask for your consent.

4.5 We do not sell your personal data.

5.1 We only share the personal data that is needed for the purpose concerned. We may share it with:

(a) Product providers and platforms, so that we can arrange and help administer the products you choose. They use your personal data as separate data controllers under their own privacy notices. We do not share your health information with product providers or insurers.
(b) Our outsourced Anti-Money Laundering Compliance Officer (AMLCO) and Money Laundering Reporting Officer (MLRO), who support our AML/CTF compliance.
(c) Our screening provider, which we use to screen clients and connected parties against sanctions, PEP and adverse media lists and for ongoing monitoring.
(d) Technology service providers, including providers of client relationship management, email and document storage, electronic signature, email marketing, meeting booking, administrative and AI-assisted productivity tools that work under our instructions, and the hosting of our website and its forms.
(e) Regulators, law enforcement and other authorities, such as CIMA and the Financial Reporting Authority, where we are legally required to do so.
(f) Professional advisers, such as our auditors, lawyers and insurers, where this is needed for the running of our business.
(g) Anyone you ask us to share it with, or who you authorise to act on your behalf.
(h) Meta, but only the limited technical information described in Section 10, and only if you accept advertising cookies.

5.2 Service providers who process personal data on our behalf may only use it in line with our instructions. We carry out due diligence on them and require them to keep your personal data confidential and secure.

5.3 Our meeting booking uses a third-party embedded scheduler, which may set its own cookies under its provider's own privacy policy; those cookies are not controlled by our cookie banner.

6. International transfers

6.1 Some of the organisations we share personal data with store or process it outside the Cayman Islands. For example, our cloud and software providers may process data in other countries, our screening provider processes data in the United States, and some product providers are based in other jurisdictions.

6.2 Under the DPA, we only transfer personal data outside the Cayman Islands where the destination ensures an adequate level of protection for it, or where another condition permitted by the DPA applies (for example, where the transfer is necessary to perform our agreement with you, or you have consented). We assess our providers before using them and put appropriate contractual protections in place.

6.3 If you would like more information about how we protect personal data transferred outside the Cayman Islands, please contact us using the details in Section 12.

7. How long we keep your personal data

7.1 We keep personal data only for as long as we need it for the purpose for which it was collected, or for as long as the law requires.

7.2 Under the Anti-Money Laundering Regulations, we keep client due diligence records, identification documents, screening results, transaction records and related records for at least five years after our business relationship with you ends (or, for transaction records, from the date of the transaction). We keep client files, fact-finds and records of advice, including any health information they contain, for at least five years after our business relationship with you ends. We may keep them for longer where an investigation is ongoing or where the law or a regulator requires us to.

7.3 If you send us an enquiry or book a meeting but do not become a client, we keep your details for 12 months after our last contact with you, unless we need them for longer for a legal reason. If you subscribe to our email updates, we keep your details until you unsubscribe, and then keep only a minimal record so that we do not contact you again.

7.4 We may also keep personal data for longer where it is needed to deal with a complaint or to establish, exercise or defend legal claims.

7.5 When we no longer need your personal data, we securely delete or anonymise it.

8. How we keep your personal data secure

8.1 We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or disclosure. These include role-based access controls, encryption provided by our cloud service providers, anti-malware protection, secure cloud storage with regular backups, staff training and due diligence on our service providers.

8.2 No method of sending information over the internet is completely secure. Please take care when sending us personal data and use any secure method we provide for sending identification and financial documents.

8.3 We have procedures for responding to personal data breaches. If a breach occurs, we will notify the Cayman Islands Ombudsman and the people affected where the DPA requires us to do so.

8.4 Please help us keep your personal data accurate by telling us promptly about any changes.

9. Your rights

9.1 Under the DPA you have the following rights:

(a) To be informed about how we use your personal data. This policy is designed to do that.
(b) To access the personal data we hold about you and to receive information about how we use it.
(c) To rectification: to ask us to correct personal data that is inaccurate or incomplete.
(d) To stop or restrict processing: to ask us, in certain circumstances, to stop processing your personal data or not to begin processing it.
(e) To object to direct marketing: to object at any time to our use of your personal data for direct marketing. You can unsubscribe at any time using the link in any marketing email or by emailing info@central.ky, and we will stop sending you marketing.
(f) To withdraw consent: where we rely on your consent (for example, for advertising cookies), to withdraw it at any time. This does not affect anything we did before you withdrew it.
(g) To complain to the Cayman Islands Ombudsman (see Section 12).

9.2 To exercise any of these rights, please email us at info@central.ky. We may need to verify your identity before we respond. We will respond within the time required by the DPA and will not normally charge a fee.

9.3 Some rights are subject to limits. For example, where the law requires us to keep records (such as the AML records described in Section 7), we may not be able to stop processing or delete them. If you ask us to stop processing personal data that we need to provide our services, we may not be able to continue acting for you.

10. Cookies and similar technologies

10.1 Our website uses essential cookies that it needs to work. With your consent, we also use the Meta Pixel, a tool provided by Meta Platforms, to measure how well our Facebook and Instagram advertising works and to show our adverts to relevant audiences. When enabled, the Meta Pixel places cookies on your device and sends Meta technical information such as your IP address, browser and device details, the pages you visit on our website, and whether you submitted an enquiry form or clicked to book a meeting. We do not send Meta your name, email address, telephone number, financial information or fact-find answers. Meta may process this information outside the Cayman Islands, including in the United States, and uses it in line with its own privacy policy (https://www.facebook.com/privacy/policy). The Meta Pixel only loads if you select 'Accept' on our cookie banner, and you can withdraw or change your choice at any time using the 'Cookie settings' link at the foot of each page. Refusing advertising cookies does not affect your use of our website or our services. If you have questions about how we use your personal data, please contact us at info@central.ky.

11. Changes to this policy

11.1 We may update this policy from time to time. The latest version will always be available on our website, with its version date shown at the top. If we make significant changes, we will take reasonable steps to let you know.

11.2 This policy replaces any privacy notice previously published on our website.

12. Contact us and complaints

12.1 If you have any questions about this policy or how we use your personal data, or you wish to exercise your rights, please contact us by email at info@central.ky or by post at Central Advisors Limited, PO Box 31910, KY1-1208 Cayman Islands.

12.2 If you are unhappy with how we have handled your personal data, please send your complaint to complaints@central.ky so that we can try to put things right. We will deal with it under our Complaints Policy.

12.3 You also have the right to complain to the Office of the Ombudsman, which supervises compliance with the DPA in the Cayman Islands. You can find its contact details at www.ombudsman.ky.

12.4 This policy is governed by the laws of the Cayman Islands.