Privacy policy

Privacy Policy and Cookie Policy TigerInvest a.s. Effective date: 26.03.2026 This document combines the Privacy Policy and Cookie Policy for publication on the TigerInvest website.

TigerInvest a.s., with its registered office at Bilkova 855/19, Stare Mesto, 110 00 Prague 1, Czech Republic, Company ID No. 118 81 844, registered in the Commercial Register maintained by the Municipal Court in Prague, Section B, Insert 26658, acting through its sole member of the Board of Directors authorized to act independently, Alessandro Alagia, ("TigerInvest", "we", "us" or "our") respects your privacy and is committed to protecting personal data in accordance with Regulation (EU) 2016/679 (GDPR), Act No. 110/2019 Coll., on the Processing of Personal Data, and other applicable laws of the Czech Republic.

This Privacy Policy explains how we collect, use, store, disclose and otherwise process personal data when you visit our website, contact us, request information, use our services, enter into a contractual relationship with us, or otherwise interact with TigerInvest.

1. Who is the data controller

The controller of your personal data is TigerInvest a.s., Bilkova 855/19, Stare Mesto, 110 00 Prague 1, Czech Republic, Company ID No. 118 81 844. For any questions regarding this Privacy Policy or the processing of your personal data, you may contact us at privacy@cps-bank.com.

2. What personal data we process

Depending on the nature of our relationship with you, we may process the following categories of personal data: • identification data, such as first name, last name, title, date of birth, nationality, company name, position, company registration details and tax identification details; • contact data, such as email address, telephone number, correspondence address and billing address; • account, payment and transaction-related data, including bank account details, payment references and other information necessary for payment processing or administration of contractual relations; • contractual and business data, such as information contained in inquiries, orders, contracts, onboarding forms, communications, instructions, service requests and supporting documentation; • compliance and due diligence data, where applicable, including information required for identity verification, fraud prevention, sanctions screening, anti-money laundering checks, know-your-customer procedures, source-of-funds verification and related legal obligations; • technical and website usage data, such as IP address, browser type, device identifiers, approximate location, access times, referring pages, pages visited and cookie-related information;

• communication data, such as email correspondence, contact form submissions, customer support records and other communications with us; • marketing preference data, such as preferences regarding receiving newsletters, product updates and commercial communications; • any other personal data that you voluntarily provide to us or that is necessary for the relevant legal or business purpose. We do not intentionally collect special categories of personal data unless this is required by law, necessary for the establishment, exercise or defense of legal claims, or voluntarily provided by you in circumstances where processing is legally permitted.

3. How we collect personal data

• directly from you when you contact us, fill in forms, request information, submit documents, enter into a contract, use our services or communicate with us; • from your employer, company, authorized representatives, intermediaries or counterparties where relevant to the services requested; • from public registers, public authorities, sanctions lists, insolvency registers, company registers and other publicly available sources where permitted by law; • from service providers, payment providers, banking partners, professional advisers, identity verification providers or compliance partners where necessary; • automatically through our website and related technologies, including cookies and server logs.

4. Purposes and legal bases for processing

a) Performance of a contract or steps prior to entering into a contract • respond to your requests and inquiries; • prepare offers, proposals and contractual documentation; • provide our services and manage our business relationship with you; • administer payments, invoicing, reporting and customer support; • verify your instructions and communicate with you regarding our services.

b) Compliance with legal obligations • accounting and tax compliance; • prevention of money laundering and terrorist financing; • fraud prevention and internal control; • responding to lawful requests from courts, regulators, law enforcement agencies and public authorities; • record-keeping and reporting obligations.

c) Legitimate interests We may process personal data where necessary for our legitimate interests, provided that such interests are not overridden by your rights and freedoms. These legitimate interests may include operation, security and improvement of our website, systems and services, administration of client, supplier and business partner relationships, internal reporting, corporate governance and risk management, protection of our rights, property and legal claims, prevention of fraud, abuse, unauthorized access and other harmful activity, and direct marketing in relation to our own similar services where permitted by law.

d) Consent

Where required by law, we will process your personal data based on your consent, for example for certain cookies or for marketing communications where consent is necessary. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

5. Cookies and website technologies

Our website may use cookies and similar technologies to ensure proper website functionality, improve user experience, analyze traffic and, where applicable, support marketing activities. This section forms an integral part of this Privacy Policy and also serves as our Cookie Policy.

To count visits we use Umami, installed on our own servers: it uses no cookies and no identifiers that follow you across sites, and the data never leaves our infrastructure in the European Union. We do not use Google Analytics or any other third-party analytics tool.

5.1 What cookies are Cookies are small text files stored on your device when you visit a website. They help the website function correctly, remember your preferences, improve performance, and provide information about how the website is used. Cookies may be set directly by us (first-party cookies) or by selected third-party providers whose services are used on the website.

5.2 Types of cookies we may use • Strictly necessary cookies, which are required for the operation, security and basic functionality of the website and cannot be switched off in our systems; • Preference cookies, which remember user choices and settings, such as language or display preferences; • Analytical cookies, which help us understand how visitors use the website, measure website performance and improve content and functionality; • Marketing cookies, which may be used to deliver relevant information or measure the effectiveness of communications, where such tools are implemented in the future.

5.3 Legal basis for the use of cookies Strictly necessary cookies are processed on the basis of our legitimate interest in ensuring the secure and proper functioning of the website. All non-essential cookies, including analytical, preference or marketing cookies where required by law, will only be used after you provide valid consent through the cookie banner or another consent management mechanism implemented on the website.

5.4 Third-party cookies If our website uses third-party services such as website analytics tools, embedded content, maps, videos, communication tools or advertising technologies, such third parties may place cookies or similar technologies on your device. The processing of personal data by such third parties is governed by their own privacy terms and policies.

5.5 Cookie retention period Some cookies remain on your device only for the duration of your browsing session and are deleted automatically when you close your browser. Other cookies remain stored for a defined period or until manually deleted, depending on their purpose and settings.

5.6 Managing cookies Most web browsers allow you to control cookies through browser settings. You can usually set your browser to block cookies, delete cookies already stored, or notify you before cookies are placed. Please note that restricting certain cookies may affect the availability or proper functioning of some parts of the website.

6. Recipients of personal data

We may disclose personal data, on a need-to-know basis and subject to appropriate safeguards, to the following categories of recipients: • our employees, officers and authorized personnel;

• affiliated companies within our group, where relevant; • banks, payment institutions, financial partners and service providers involved in the provision of requested services; • IT, hosting, cloud, software, cybersecurity and website service providers; • accountants, auditors, legal advisers, tax advisers, consultants and other professional advisers; • identity verification, compliance, AML, sanctions screening and fraud prevention providers; • couriers, postal operators, document management providers and administrative support providers; • courts, regulators, supervisory authorities, law enforcement agencies and public bodies where disclosure is required by law or necessary to protect our rights.

7. International transfers

As a rule, we aim to process personal data within the European Economic Area. If personal data is transferred outside the EEA, we will do so only where permitted by law and where appropriate safeguards are in place, such as an adequacy decision by the European Commission, standard contractual clauses, binding corporate rules or another lawful transfer mechanism.

8. How long we keep personal data

We retain personal data only for as long as necessary for the purposes for which it was collected, including for the purposes of satisfying legal, accounting, tax, regulatory, contractual and evidentiary requirements. • contractual and business data is retained for the duration of the contractual relationship and thereafter for the limitation period necessary to establish, exercise or defend legal claims; • accounting and tax documents are retained for the period required by applicable law; • AML, KYC and compliance-related records are retained for the period required by applicable AML and related regulations; • communications and inquiries may be retained for as long as necessary to handle the matter and for a reasonable follow-up period; • website technical data and cookie data are retained according to the relevant technical and legal settings.

9. Your rights

Subject to the conditions set by GDPR and applicable Czech law, you have the right to: • request access to your personal data; • request rectification of inaccurate or incomplete personal data; • request erasure of personal data where the legal conditions are met; • request restriction of processing in certain circumstances; • object to processing based on legitimate interests, including direct marketing; • receive your personal data in a structured, commonly used and machine-readable format and request its transfer to another controller where applicable; • withdraw consent at any time where processing is based on consent; • not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where legally permitted. To exercise your rights, please contact us at privacy@cps-bank.com. We may ask you to verify your identity before responding to your request.

You also have the right to lodge a complaint with the competent supervisory authority. In the Czech Republic, this is the Office for Personal Data Protection (Urad pro ochranu osobnich udaju), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic.

10. Security of personal data

We implement appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access or other unlawful forms of processing. Such measures include, where appropriate, access controls, internal authorization procedures, secure storage, contractual confidentiality obligations, cybersecurity protections and data minimization practices. However, no method of transmission over the internet or electronic storage is entirely secure, and we therefore cannot guarantee absolute security.

11. Data provided by third parties

If you provide us with personal data relating to another individual, you are responsible for ensuring that you are authorized to provide such data and, where required by law, that the relevant individual has been informed of this Privacy Policy.

12. Children

Our website and services are not directed to children, and we do not knowingly collect personal data from children without a lawful basis and, where required, appropriate authorization.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, business operations, legal requirements or regulatory guidance. The current version will always be published on our website together with its effective date. Where changes are material, we may take additional steps to inform data subjects where appropriate.

14. Contact

TigerInvest a.s. Bilkova 855/19, Stare Mesto 110 00 Prague 1 Czech Republic Company ID No.: 118 81 844 Email: privacy@cps-bank.com