Privacy Statements

BBG Limited Privacy Statement

Date: 30 June 2026

Entity: BBG Limited (JUC Building, Office F7B, Providence Zone 18, Mahe, Seychelles)

Trading Name: BlackBull Markets

Contact Details:

• Phone: +248 437 6183
• Email: support@blackbull.com
• Website: www.blackbull.com

Why do we have a Privacy Statement?

We understand the importance of the honest and responsible use of your personal information. This Privacy Statement (“Statement”) is formulated in compliance with the Data Protection Act 2023 (DPA 2023) and the Financial Consumer Protection Act 2022 (FCPA 2022). The DPA 2023 aims to protect individuals’ rights regarding the processing of personal data, recognizing the right to privacy under Article 20 of the Constitution.

Where we process personal information of individuals located in the European Economic Area or the United Kingdom, we will do so in accordance with applicable data protection laws, including the European Union General Data Protection Regulation (EU) 2016/679 and the United Kingdom General Data Protection Regulation (together, the “GDPR“).

The purpose of this Statement is to explain how we collect, store, use, and disclose personal information about you in your day-to-day dealings with us and when you visit our website. In this Statement, “the Company”, “we”, “our”, and “us” refers to BBG Limited and the services provided under the BlackBull Markets trading name. For the purposes of this Statement, we refer to the information that we collect about you as “personal information”.

Agreeing to this Privacy Statement

By accessing our website and using our services, you consent to the collection, storage, use, and disclosure of your personal information in accordance with this Statement.

In addition to any consent you provide, we process personal information where this is necessary to perform our contractual obligations, comply with legal or regulatory requirements, or where otherwise permitted under the Seychelles Data Protection Act 2023 and/or the GDPR. This includes processing required for anti-money laundering and counter-terrorism financing compliance, risk management, fraud prevention, and the operation of our business.

What personal information do we collect about you?

During the account opening process for a demo or live trading account we may collect the following personal information necessary for identity verification and compliance with applicable laws and regulations governing the provision of the services:

• Your name and date of birth;
• Email address, residential address, and phone number;
• Bank account information, occupation, income, and other financial details;
• Identity verification documents;
• Information to assess your suitability for our services;
• Details of services you use and your interaction with them;
• Transaction activity on your accounts;
• Correspondence between you and us; including calls, webchat and social messaging;
• Your marketing preferences;
• IP address, device type, user agent and ID;
• Any additional information required to meet our legal and regulatory obligations.

The above list is non exhaustive and may include other sensitive personal data as defined by the Seychelles Data Protection Act 2023 (DPA 2023) and/or the GDPR. If you provide personal information about another person, you confirm you are authorised to do so and have informed them of the terms of this Statement.

What happens if you don’t provide personal information?

Providing personal information is optional. However, if you choose not to provide requested information, we may be unable to provide services or access to parts of our website.

How we collect your personal information

We may collect information:

• When you contact us;
• When you request information or use our website or services;
• When you make a deposit or withdrawal;
• When you participate in promotions or surveys;
• From public sources or third parties where authorised.

How we may use your personal information

We only use your personal information for the purpose it was collected and retain it only as long as necessary to meet our obligations.

We rely on the following legal bases when processing your personal information:

• Performance of a contract: for example, to provide you with our trading platform and related services, and assess your application;
• Compliance with legal obligations: for example, to carry out identity checks and comply with anti-money laundering and regulatory reporting requirements;
• Legitimate interests: including managing our relationship with you, operating, administering and improving our business and services, promoting our business, ensuring the security of our information and systems, preventing fraud and financial crime, provided these interests are not overridden by your rights; and
• Consent: where required by law (e.g. to send you marketing communications).

We may use your personal information in the following ways:

Personal information	Purpose for collecting this personal information	Lawful bases
Name, date of birth, residential address, contact details, government-issued identification (e.g. passport, driver licence), verification data, credit history, political exposure and sanctions data, and other identity verification information.	Verifying your identity and meeting anti-money laundering requirements.	Compliance with legal obligations Legitimate interests
Name, date of birth, contact details, financial information (including income, employment, and source of funds), trading experience, risk profile information, and other information provided as part of your application.	Assessing your application and providing services.	Performance of a contract
Name, contact details, account information, transaction and trading data, financial information (including account balances and payment details), communications, and service usage data.	Managing your account and communications.	Performance of a contract Legitimate interests
Name, contact details (including email and phone number), marketing preferences, account information, and limited service usage data.	Sending you information about our services. We will process your communication preferences based on your most recent instruction. Where you have previously opted out of communications but later request assistance or access to services that require communication (such as account access or security verification), we may resume sending the communications necessary to provide those services. It is your responsibility to ensure that you are able to receive essential service-related communications from us where required to access or use our services.	Legitimate interests Consent
Contact details (such as email address), marketing identifiers, device and online identifiers (such as IP address and cookie identifiers), and limited service usage data.	Provide personalised advertising, including on third-party platforms. This may involve sharing limited personal information (such as your email address or other identifiers), which may be converted into a hashed or pseudonymised format, with digital advertising and social media platforms to enable us to match you with your account on those platforms and show you more relevant advertising. We may also use cookies and similar tracking technologies (such as pixels or tags) to support these activities and to measure the effectiveness of our advertising. You can opt out of personalised advertising at any time by contacting us or by using the privacy or advertising settings made available by those third-party platforms.	Legitimate interests Consent
Account information, transaction and trading data, service usage data, and aggregated or de-identified data derived from personal information.	Internal research and optimisation.	Legitimate interests
De-identified or aggregated data derived from transaction data, usage data, and account information, which does not directly identify you.	De-identified data for business analysis.	Legitimate interests
Name, contact details, identification information, account information, transaction and trading data, financial information, communications, and any other information required to comply with legal and regulatory obligations.	Legal or regulatory compliance.	Compliance with legal obligations
Name, contact details, employment and education history, qualifications, references, and any information provided in your application.	Employment applications.	Legitimate interests Compliance with legal obligations

We may also collect personal information for any other purpose notified at the time of collection.

We use automated tools (such as security and fraud prevention systems) to monitor and protect our services and your data, including automatically blocking or challenging suspicious activity. We do not otherwise use automated processing to make decisions that have legal or similarly significant effects on individuals without human involvement.

We may receive personal information about you from third parties, and these third parties may collect personal information directly from you and share it with us for the purposes above. We will only collect and process personal information from third parties where we are permitted to do so under applicable data protection laws.

Where we do not otherwise have a lawful basis to process your personal information, we will obtain your consent in accordance with applicable data protection laws.

Sharing and transfer of your personal information

We may share your information with:

• Third parties for identity verification and compliance checks;
• Service providers assisting us in delivering our services;
• Liquidity providers, platform providers, or other agents;
• Regulatory and legal authorities;
• Financial institutions and professional advisors;
• Entities acquiring a business interest in us;
• Other recipients with your consent;
• Any party as permitted under the Seychelles Data Protection Act 2023, the GDPR or other applicable law;
• Law enforcement or judicial authorities as required;
• Digital advertising and marketing partners, including social media platforms and online advertising providers, for the purpose of delivering, measuring and optimising advertising.

In order to provide services to you the Company may be required to transfer your personal information to parties located outside of Seychelles i.e. in the European Economic Area or in countries which may not have an equivalent level of data protection laws as in the Seychelles. Where this is the case, the Company will take reasonable steps to ensure the privacy of your information, as required under Section 47 of the DPA 2023.

If you are based in the European Economic Area or the United Kingdom, where we transfer your personal information outside of the United Kingdom or European Economic Area, we will ensure appropriate safeguards are in place to protect your personal information. These safeguards include the use of standard contractual clauses approved by the European Commission and the UK Information Commissioner, together with supplementary measures where required to ensure an adequate level of protection in accordance with applicable data protection laws. You have the right to request further information about these safeguards and you can request a copy of these safeguards from us by using the contact details set out in the appendix of this Statement.

The Company may also share information with affiliates or any other company in the same group of the company in the event such information is reasonably required in order to provide the products or services to you. The Company may share information with partners, affiliates and associates in order to offer additional similar products and services that meet your needs and which are delivered in a manner that is useful and relevant only where you have authorized the Company to do so.

In cases where you have been introduced by a third party such as a Business Introducer, such Business Introducer may have access to your information. You hereby consent to the sharing of information with such Business Introducer.

All third parties with which the Company shares personal information are required to protect such personal information in accordance with all relevant legislation and in a manner similar to the way the Company protects the same. The Company will not share personal information with third parties which it considers will not provide you the required level of protection.

Where you voluntarily establish a business relationship with the Company, you consent to the electronic disclosure of your non-public consumer data through your acceptance of the Client Services Agreement when creating your account.

Application of overseas privacy laws

Our website and services may be accessed from outside Seychelles. By using our services, you consent to your personal information being transferred, processed, and stored outside your location in accordance with this Statement and the Seychelles Data Protection Act 2023. We take the necessary steps to ensure equivalent protection standards are applied.

If you are located in a country with applicable data protection laws, we will comply with those to the extent required. If you have concerns about international transfers, or wish to withdraw consent, you may contact us as outlined below. Withdrawal may impact our ability to provide some services.

How we store and protect your personal information

We store personal information electronically and in hard copy. We apply appropriate technical and administrative security measures to protect against unauthorised access, loss, misuse, or disclosure. There are inherent risks in internet communications; we encourage you to take steps to protect your information and notify us of any suspected compromise.

Duration of storage

We retain personal information only as long as necessary to:

• Fulfil the purposes for which it was collected;
• Provide services to you;
• Meet legal obligations or assert legal rights;
• Fulfil any other legitimate purpose in accordance with the Seychelles Data Protection Act 2023 or GDPR.

The retention periods for the following key types of information are as follows:

• AML/KYC information: 7 years;
• Account and transaction data: 7 years for accounting and regulatory purposes;
• Marketing data: until consent is withdrawn or you opt out; and
• Customer communications: up to 7 years for dispute resolution and audit purposes.

Once the retention period expires, data will be anonymized, archived, or securely erased, following Section 16 of the DPA 2023 or GDPR.

Data security and breach notification

The Company shall implement appropriate technical, organizational, and physical security measures to protect personal data from unauthorized access, loss, alteration, or destruction.

In case of a personal data breach, the Company will notify the Information Commission within 72 hours, as required under Section 43 of the DPA 2023. If the breach poses a high risk to the rights and freedoms of clients, affected individuals will also be informed promptly.

In addition, where we process personal information of individuals located in the European Economic Area or the United Kingdom, we will comply with the GDPR. This includes notifying the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, and notifying affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

Cookies and web tracking

We use cookies and similar technologies (such as pixels, tags, and local storage) to operate our website, understand how it is used, improve our services, and support our marketing and advertising activities. These technologies may collect information such as your IP address, browser type, device identifiers, and information about how you interact with our website.

We may use these technologies, together with other identifiers (such as your email address), to support personalised advertising on third-party platforms. This may involve sharing limited personal information, which may be converted into a hashed or pseudonymised format, with digital advertising and social media providers to enable us to show you more relevant advertising and measure its effectiveness. Even where information is hashed or pseudonymised, it may still be considered personal information under applicable data protection laws.

Where required by applicable law, we will obtain your consent before using non-essential cookies or similar technologies.

You can control or disable cookies through your browser settings or through any cookie preference tools we make available. You can also opt out of targeted advertising by contacting us or by using the privacy or advertising settings provided by relevant third-party platforms. Please note that disabling cookies may affect the functionality of our website.

Amendments to Statement

The Company reserves the right to make changes to this Privacy Statement from time to time for any reason and you will be notified of such changes by us posting an updated version of this Privacy Statement on the website. You are responsible for regularly reviewing this Privacy Statement and the use of this website after any such changes are published, shall constitute an agreement to such changes.

Legal disclaimer

The Company will not be liable for misuse or loss of personal information resulting from cookies on the Company’s site(s) that the Company does not have access to or control over. The Company will not be liable for any unlawful or unauthorized use of your personal information due to the negligent or malicious misuse or misplacement of your passwords.

Making a privacy complaint

If you believe your privacy has been compromised, please contact us in the first instance so that we can address your concerns. If you are in the UK, we will acknowledge your complaint without undue delay and respond within 30 days.

If you are in the European Economic Area or UK, you also have the right to complain to supervisory authorities if you have concerns about privacy. A list of EU supervisory authorities and their contact details is available on the European Data Protection Board’s website (www.edpb.europa.eu/about-edpb/about-edpb/members_en). If you are in the UK, please visit the ICO’s website (ico.org.uk), contact the ICO by telephone on +44 (0)303 123 1113 or write to the ICO at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom.

You also have the right to complain to supervisory authorities if you have concerns about privacy.

New Zealand

If you are based in New Zealand, you can ask the New Zealand Office of the Privacy Commissioner to investigate your privacy complaint at any time. For more information, visit the Privacy Commissioner’s website (www.privacy.org.nz) or call 0800 803 909.

How to contact us

If you have any questions about this Statement, or your privacy and risks, or would like to provide feedback, please email us at compliance@blackbull.com.

Appendix – Data Subject Rights and Data Deletion Requests

Your Rights Under the Data Protection Act 2023 (DPA 2023) and the GDPR

As a client of BlackBull Markets (BBG Limited), you have a number of rights regarding your personal data under Part V of the Seychelles Data Protection Act 2023 and the GDPR.

• Right to be informed – You have the right to be informed about the collection and processing of your personal data.
• Right of access – You may request access to the personal data we hold about you and to receive certain information about how we use it.
• Right to rectification – You may request that we correct or update inaccurate or incomplete personal data.
• Right to deletion – You may request the deletion of your personal data (also known as the “right to be forgotten”), subject to legal and regulatory exceptions.
• Right to object – You may object to the processing of your personal data where we rely on legitimate interests, and you have a right to object to the use of your personal information for direct marketing purposes.
• Right to data portability – You may request to receive your personal data in a structured, commonly used and machine-readable format and to request that it is transmitted to another data controller, where technically feasible.
• Right to compensation – Under the Seychelles Data Protection Act 2023, you may be entitled to compensation for material or non-material damages resulting from a breach of applicable data protection laws.

In addition to the above rights, if you are located in the European Economic Area or the United Kingdom, you also have the following rights under the GDPR:

• Right to restriction of processing – You have the right to request that we restrict the processing of your personal information in certain circumstances.
• Right to withdraw consent – Where we rely on your consent to process your personal information, you have the right to withdraw your consent at any time.

How to Exercise Your Rights

To exercise any of the above rights, please contact our Compliance Team by email at: compliance@blackbull.com. Include the following in your request:

• Your full name and contact details;
• The specific right you wish to exercise;
• Relevant supporting information (e.g., account number, data category, or context).

Please use an appropriate subject line such as: Data Subject Rights Request – [Right Name].

Identity Verification

To ensure we are protecting your privacy and preventing unauthorized access, we may request additional information or identification to verify your identity before fulfilling your request.

Response Timeframes

We will acknowledge receipt of your request within 5 business days and aim to respond fully within 15 business days, depending on the complexity and nature of the request.

Limitations and Exceptions

We may not be able to comply with your request in full where:

• Retention is required to comply with legal or regulatory obligations;
• The data is necessary for the establishment, exercise, or defense of legal claims;
• Fulfilling the request would infringe on the rights or freedoms of other individuals;
• System integrity or contractual obligations would be adversely impacted.

If your request cannot be granted in full, we will provide a clear explanation.

Final Notification

Upon completion of your request, we will inform you of the outcome — whether your request has been fulfilled or, where applicable, explain the reasons for partial or full refusal.