1. INTRODUCTION AND SCOPE

CB NATIONAL ("CB NATIONAL", "we", "us", or "our") is fully committed to protecting the privacy, confidentiality, and security of the personal data of every individual who visits our website at CBNational.com (the "Website"), registers a client account, engages with our precious metals trading and investment services, or corresponds with our team in any capacity.

This Privacy Policy sets out in clear and transparent detail how CB NATIONAL collects, receives, uses, processes, stores, protects, transfers, and where applicable discloses personal information in connection with our precious metals trading, bullion supply, vault storage, international logistics, and all related financial and operational services (collectively, the "Services").

CB NATIONAL is incorporated and headquartered in the Hong Kong Special Administrative Region, People's Republic of China. Our primary data protection obligations are governed by the Personal Data (Privacy) Ordinance (Cap. 522) ("PDPO") and its subsidiary legislation. Where CB NATIONAL processes personal data of individuals located in the European Economic Area or the United Kingdom, we comply concurrently with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable national implementing legislation. Where we process personal data of California residents, we comply with the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act ("CPRA"). Where other international data protection frameworks apply to our processing activities, we endeavor to comply with those frameworks to the extent required by applicable law.

This Policy applies to all personal data processed by CB NATIONAL, whether collected through our Website, through direct client onboarding, through telephone and email correspondence, through our vault storage and logistics arrangements, or through any other channel through which clients and prospective clients engage with us.

By accessing our Website, submitting an inquiry, opening a client account, or engaging our Services in any capacity, you confirm that you have read, understood, and agree to the collection and use of your personal data as described in this Privacy Policy. If you do not agree with the practices described herein, you should discontinue your use of our Website and Services and contact us to discuss the implications for any existing account relationship.

2. DATA CONTROLLER INFORMATION

The entity responsible for your personal data as the data controller is:

CB NATIONAL
[Registered Company Address Placeholder]
Hong Kong Special Administrative Region
People's Republic of China
Email: Trade@CBNational.com

For all data protection enquiries, subject access requests, or complaints, please direct your correspondence to our Data Protection Officer using the contact details provided in Section 20 of this Policy.

Where CB NATIONAL engages third-party service providers to process personal data on its behalf, those providers act as data processors and are bound by written data processing agreements that impose data protection obligations equivalent to those described in this Policy.

3. PERSONAL DATA WE COLLECT

CB NATIONAL collects personal data only to the extent necessary and proportionate to the purposes described in this Policy. The categories of personal data we collect include the following.

3.1 Identity and Contact Data

Full legal name, date of birth, gender where required for identification purposes, nationality and country of citizenship, country of residence and domicile, government-issued identification numbers including passport number, national identity card number, and equivalent documents, residential address and registered business address, personal and business telephone numbers, and personal and business email addresses.

3.2 Financial and Transaction Data

Bank account details and payment method information, bank wire transfer records and transaction references, trade order history and execution records, bullion purchase and sale documentation, trade confirmations and settlement records, source of funds declarations and supporting documentation, source of wealth information and documentation, invoice history and billing records, payment receipts and accounting records, and all documentation related to the acquisition, storage, transfer, delivery, and disposal of precious metals.

3.3 Regulatory Compliance and Verification Data

Know Your Customer (KYC) documentation packages and identity verification records, Anti-Money Laundering (AML) screening records and risk assessments, Counter-Terrorist Financing (CTF) compliance documentation, Politically Exposed Person (PEP) screening results and enhanced due diligence records, international sanctions screening outputs and watchlist check records, adverse media screening results, risk rating assessments and periodic review records, Enhanced Due Diligence (EDD) files where applicable, regulatory filings and correspondence with governmental authorities, and all records required to be maintained under Hong Kong's Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) and applicable international standards.

3.4 Technical and Usage Data

Internet Protocol (IP) address, device identifiers and hardware information, browser type and version, operating system and platform, referring URLs and exit pages, pages visited and content accessed on our Website, time and duration of visits, clickstream data and navigation patterns, session identifiers and authentication tokens, geolocation data at the country or regional level, cookie identifiers and preference settings, and log data generated by your interactions with our systems.

3.5 Communications Data

All email correspondence with CB NATIONAL, telephone call records where lawfully permitted and disclosed to you at the commencement of the call, live chat session logs, form submissions and quotation requests, customer service and support enquiry records and their resolutions, marketing preference records and opt-out requests, and records of all consents provided by you in connection with our Services.

3.6 Professional and Employment Data

Professional title and designation, employer name and industry sector, professional qualifications and regulatory authorizations where relevant to the Services, professional references where required by our compliance processes, and business contact information.

3.7 Corporate and Institutional Data

For corporate, institutional, and wholesale clients: company name and jurisdiction of incorporation, company registration number and certificate of incorporation, memorandum and articles of association or equivalent constitutional documents, beneficial ownership structure and Ultimate Beneficial Owner (UBO) declarations, director and officer details and identity verification documentation, authorized signatory details and board resolutions, business licenses and regulatory authorizations, tax identification numbers and VAT registration details, corporate bank account information, and professional references and financial statements where required by our due diligence process.

3.8 Sensitive Personal Data

CB NATIONAL does not ordinarily collect sensitive categories of personal data, such as health information, racial or ethnic origin, political opinions, or biometric data. Where such data is incidentally provided or is required for a specific compliance purpose, it will be processed only with your explicit consent or as otherwise permitted by applicable law, and will be subject to additional safeguards appropriate to its sensitivity.

4. HOW WE COLLECT YOUR PERSONAL DATA

4.1 Direct Collection

We collect personal data directly from you when you access and interact with our Website, complete our client registration and onboarding process, submit KYC and AML documentation, request a trade quotation or pricing information, place a purchase or sale order, apply for vault storage or logistics services, correspond with our trading desk or account management team by any means, participate in market research or surveys, subscribe to our publications or market intelligence services, or attend events, webinars, or conferences organized or sponsored by CB NATIONAL.

4.2 Automated Collection

When you access our Website, we automatically collect certain technical and usage data through cookies, web server logs, analytics platforms, security monitoring systems, and similar technologies. This data is collected to support the operation and security of our Website, to analyze usage patterns and improve our digital services, and where applicable to support our marketing activities. Please refer to Section 12 for a full explanation of our use of cookies and tracking technologies.

4.3 Third-Party and Public Sources

We may receive personal data about you from authorized third-party sources, including identity verification and electronic document authentication providers, credit reference and financial assessment agencies, international sanctions and PEP screening database providers, national and international public corporate registries and regulatory databases, adverse media and reputational screening providers, business intelligence and due diligence platforms, financial institutions and correspondent banks, referral partners and introducers where applicable and properly disclosed, and regulatory and law enforcement authorities where required by law.

4.4 Inferred and Derived Data

We may derive certain information about you from the data you provide or that we collect automatically, including assessments of your risk profile for compliance purposes, your trading preferences based on order history, and your communication preferences based on your interactions with our Website and correspondence.

5. PURPOSES AND USE OF YOUR PERSONAL DATA

CB NATIONAL processes personal data only for specified, explicit, and legitimate purposes. We do not process personal data in any manner that is incompatible with those purposes. Our processing purposes are as follows.

5.1 Client Onboarding and Account Management

Verifying your identity and conducting KYC due diligence, assessing your eligibility for our Services, establishing and administering your client account, maintaining accurate and up-to-date client records, communicating account-related information and updates, and providing ongoing account management support.

5.2 Service Delivery and Transaction Processing

Processing and executing precious metals trade orders, arranging allocated vault storage and issuing Storage Certificates and Vault Warrants, coordinating secure international shipping and logistics for bullion consignments, issuing trade confirmations, invoices, receipts, and settlement documentation, managing delivery and storage arrangements on your behalf, and responding to all service enquiries and operational support requests.

5.3 Legal, Regulatory, and Compliance Obligations

Conducting mandatory KYC, AML, and CTF due diligence as required under Hong Kong's Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) and related regulatory guidelines, performing ongoing international sanctions and PEP screening, complying with all applicable tax reporting, withholding, and information exchange obligations including under the Common Reporting Standard (CRS) and the Foreign Account Tax Compliance Act (FATCA) where applicable, maintaining all mandatory regulatory records and audit trails for the periods required by law, fulfilling all reporting obligations to governmental bodies, financial regulatory authorities, and financial intelligence units, and responding lawfully to court orders, subpoenas, regulatory investigations, and other compulsory legal processes.

5.4 Risk Management and Financial Crime Prevention

Conducting counterparty risk assessments and ongoing monitoring, detecting, preventing, and investigating fraudulent, unauthorized, or suspicious activity, performing credit evaluations and financial assessments, managing operational, legal, reputational, and financial risk across our business, and maintaining the integrity and security of our trading platforms, client accounts, and systems.

5.5 Business Operations and Administration

Managing internal systems, IT infrastructure, and network security, conducting internal audits, compliance reviews, and management reporting, supporting business continuity planning and disaster recovery, administering contracts, professional relationships, and supplier arrangements, fulfilling insurance obligations and managing claims, and conducting strategic planning, business development, and corporate governance activities.

5.6 Marketing and Client Communications

With your consent where required, sending market intelligence reports, precious metals research and analysis publications, product and service announcements, pricing updates, event invitations, and other relevant communications related to CB NATIONAL's services and the global precious metals industry. You may withdraw your consent to marketing at any time as described in Section 16 of this Policy.

5.7 Website Analytics and Service Improvement

Analyzing user behavior, traffic patterns, and Website performance to improve the quality, functionality, and accessibility of our digital presence, evaluating the relevance and effectiveness of our content and service communications, and conducting internal research to support product development and service enhancement.

5.8 Legal Claims and Dispute Resolution

Establishing, exercising, or defending legal claims and rights arising from our client relationships, preserving evidence in connection with disputes, complaints, or investigations, and engaging in arbitration or litigation proceedings where necessary.

6. LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA

Where the GDPR or equivalent legislation applies to our processing of your personal data, we identify and rely on the following legal bases for each category of processing activity.

Contractual Necessity: Processing is necessary for the performance of our client agreements, service contracts, trade confirmations, and storage arrangements, or to take steps at your request prior to entering into such agreements. This includes executing trade orders, administering your account, and arranging storage and logistics services.

Legal Obligation: Processing is necessary to comply with our legal and regulatory obligations under applicable Hong Kong law, international AML and CTF frameworks, tax information exchange obligations, financial services regulations, and all other mandatory legal requirements to which CB NATIONAL is subject.

Legitimate Interests: Processing is necessary for the purposes of CB NATIONAL's legitimate business interests, provided those interests are not overridden by your fundamental rights and freedoms. Our legitimate interests include fraud detection and financial crime prevention, network and information security, client relationship management, business improvement and analytics, and the defense of legal claims.

Consent: Where we rely on your consent as the legal basis for a specific processing activity, such as sending you marketing communications or processing certain categories of sensitive data, you have the right to withdraw that consent at any time without affecting the lawfulness of any processing carried out prior to withdrawal. Withdrawal of consent does not affect processing carried out on other legal bases.

Vital Interests: In exceptional and limited circumstances, we may process personal data where it is strictly necessary to protect the vital interests of you or another natural person.

Public Task: In certain circumstances, we may process personal data in connection with the performance of a task carried out in the public interest, particularly in relation to our regulatory reporting and financial crime prevention obligations.

7. SHARING AND DISCLOSURE OF YOUR PERSONAL DATA

CB NATIONAL does not sell, rent, lease, or otherwise commercially exploit your personal data to any third party. We share your personal data only in the limited and lawful circumstances described below, and only to the minimum extent necessary for the specified purpose.

7.1 Authorized Service Providers and Data Processors

We engage carefully selected and contractually bound third-party service providers who process personal data strictly on our behalf and under written data processing agreements that impose data protection obligations equivalent to those we observe. These providers may include electronic identity verification and KYC platform providers, secure vault operators and bullion custodians, specialist armored freight and logistics partners, banking institutions and payment processing providers, cloud computing infrastructure and hosting providers, cybersecurity monitoring and managed security service providers, legal advisors and compliance consultants, audit and accounting firms, IT development and maintenance providers, and customer relationship management and communications platforms.

7.2 Regulatory Authorities and Law Enforcement

CB NATIONAL may be legally required to disclose personal data to governmental bodies, financial regulatory authorities, tax authorities, financial intelligence units, law enforcement agencies, or courts of competent jurisdiction in Hong Kong or internationally. Such disclosures are made only to the minimum extent required by the applicable legal obligation and following appropriate internal legal review. Where legally permissible, we will notify you of such disclosure requirements.

7.3 Professional Advisors

We share personal data with our legal advisors, external auditors, accountants, insurers, actuaries, and other professional consultants strictly on a need-to-know basis and subject to enforceable professional confidentiality obligations.

7.4 Business Transfers and Corporate Restructuring

In the event of a merger, acquisition, joint venture, demerger, reorganization, asset sale, or similar corporate transaction involving CB NATIONAL, personal data may be transferred to the relevant successor, acquirer, or counterparty entity as part of the transaction. We will take all reasonable steps to ensure that any receiving entity provides equivalent protections for your personal data, and we will notify you of any material change to the identity of the data controller arising from such a transaction where required by applicable law.

7.5 Group Entities

Where CB NATIONAL operates through affiliated or subsidiary entities, personal data may be shared within the CB NATIONAL group of companies for the purposes of group-wide risk management, compliance oversight, consolidated reporting, and service delivery, subject to internal data sharing agreements and equivalent data protection standards.

7.6 With Your Explicit Consent

We may share personal data with third parties where you have provided your prior, informed, and freely given explicit consent for a specific and clearly disclosed purpose.

8. INTERNATIONAL TRANSFERS OF PERSONAL DATA

As a Hong Kong-headquartered international precious metals trading company with global client relationships, vault storage arrangements, logistics networks, and technology infrastructure, CB NATIONAL may transfer personal data to recipients located in jurisdictions outside of Hong Kong or the European Economic Area in connection with the delivery of our Services.

Where personal data is transferred internationally, CB NATIONAL implements appropriate and legally recognized safeguards to protect your rights and the integrity of your data. Depending on the destination jurisdiction and the applicable data protection framework, these safeguards may include standard contractual clauses approved by the relevant supervisory authority, adequacy decisions or findings recognizing the destination country as providing an equivalent level of data protection, binding corporate rules where applicable, specific contractual protections negotiated with data recipients, and other legally recognized transfer mechanisms under the PDPO, GDPR, or equivalent legislation.

Jurisdictions to which personal data may be transferred include Switzerland, Singapore, the United States, Canada, and the United Arab Emirates in connection with our vault storage arrangements, as well as other jurisdictions in which our service providers, logistics partners, and correspondent banking relationships are located.

By engaging with our Services, you acknowledge that your personal data may be processed in jurisdictions outside your country of residence. Where your consent to such transfers is required by applicable law, your engagement with our Services constitutes the provision of that consent.

9. DATA RETENTION

CB NATIONAL retains personal data only for as long as is necessary and proportionate to fulfill the specific purpose for which it was collected, or as required or expressly permitted by applicable law. Our data retention decisions are governed by the following principles and obligations.

Active client records are retained for the full duration of the professional relationship and for the applicable mandatory post-termination period required by law. AML and CTF compliance records, including KYC documentation packages, transaction histories, due diligence files, screening records, and regulatory correspondence, are retained for a minimum period of six years following the termination of the client relationship or the completion of the relevant transaction, in strict accordance with Hong Kong's Anti-Money Laundering and Counter-Terrorist Financing Ordinance and applicable FATF standards. This minimum period may be extended where records are subject to ongoing regulatory investigations, legal proceedings, or enhanced retention requirements. Financial and accounting records are retained for the applicable statutory limitation period under Hong Kong tax and company law. Legal correspondence and records relevant to claims, disputes, or regulatory matters are retained for the full duration of the applicable limitation period under Hong Kong law plus a reasonable additional period to account for latent claims. Technical logs and security monitoring records are retained for the period necessary to support security investigations and operational oversight. Marketing consent records are retained for the duration of the marketing relationship plus such additional period as is required to demonstrate compliance with consent requirements. Website analytics and usage data is retained in aggregated or anonymized form following the expiry of the operational retention period.

Upon the expiry of the applicable retention period, personal data is securely destroyed, permanently deleted, or fully anonymized in accordance with CB NATIONAL's data destruction policy and applicable regulatory guidance. Anonymized data, from which all personal identifiers have been irreversibly removed, may be retained indefinitely for statistical and analytical purposes.

10. YOUR DATA PROTECTION RIGHTS

Depending on your jurisdiction of residence and the applicable data protection legislation, you may have the following rights regarding your personal data held by CB NATIONAL. CB NATIONAL is committed to respecting and facilitating the exercise of these rights promptly and transparently.

10.1 Rights Under Hong Kong PDPO

Right of Access: You have the right to request confirmation of whether CB NATIONAL holds personal data about you and, if so, to obtain a copy of that data in a form that is intelligible to you. Right of Correction: You have the right to request the correction of any personal data we hold about you that is inaccurate, incomplete, misleading, or out of date, having regard to the purposes for which it is used.

10.2 Additional Rights Under the GDPR (where applicable)

Right to Rectification: Request that we correct or update inaccurate or incomplete personal data without undue delay. Right to Erasure (Right to be Forgotten): Request that we delete your personal data in defined circumstances, including where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent and no other legal basis applies, or where the data has been unlawfully processed. Right to Restriction of Processing: Request that we limit our processing of your personal data in defined circumstances, such as where you contest the accuracy of the data or where you have objected to processing and a determination is pending. Right to Data Portability: Receive a copy of the personal data you have provided to us in a structured, commonly used, and machine-readable format, and where technically feasible, to request that it be transmitted directly to another data controller, where processing is based on consent or contractual necessity and is carried out by automated means. Right to Object: Object to our processing of your personal data where processing is based on legitimate interests or is carried out for direct marketing purposes, including profiling to the extent that it is related to direct marketing. Right to Withdraw Consent: Where processing is based solely on your consent, withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

10.3 Rights Under the CCPA and CPRA (for California Residents)

Right to Know: Request disclosure of the specific categories and pieces of personal information we have collected, used, disclosed, or shared about you over the preceding twelve-month period, the categories of sources from which it was collected, the business or commercial purpose for collection, and the categories of third parties to whom it has been disclosed. Right to Deletion: Request that we delete personal information we have collected from you and direct our service providers and contractors to delete such information, subject to certain defined exceptions including where retention is required for legal compliance. Right to Correction: Request that we correct inaccurate personal information we maintain about you. Right to Opt-Out of Sale or Sharing: CB NATIONAL does not sell personal information and does not share personal information for cross-context behavioral advertising purposes. Right to Limit Use of Sensitive Personal Information: Request that we limit our use of sensitive personal information to the purposes permitted by the CPRA. Right to Non-Discrimination: Exercise any of your CCPA privacy rights without receiving discriminatory treatment in the pricing, quality, or availability of our Services.

10.4 Rights Under Other International Frameworks

Clients based in other jurisdictions with applicable data protection legislation, including but not limited to Australia, Canada, Singapore, the United Arab Emirates, and the European Economic Area member states, may have additional rights under their respective national or regional data protection laws. CB NATIONAL endeavors to respect and facilitate the exercise of such rights to the extent required by applicable law. Please contact us to discuss your rights in your specific jurisdiction.

10.5 Exercising Your Rights

To exercise any of the rights described in this Section, please submit a written request to Trade@CBNational.com clearly identifying the right you wish to exercise, providing sufficient information to verify your identity, and specifying the personal data to which your request relates. CB NATIONAL will acknowledge receipt of your request promptly and respond within the timeframe required by applicable law. Under the GDPR, this is generally one month from the date of receipt, extendable by a further two months for complex or multiple requests with prior notification. Under the CCPA, this is generally 45 days from the date of receipt, extendable by a further 45 days with prior notification.

Identity verification is required before we can fulfill rights requests to protect your data against unauthorized access. We may request additional documentation to verify your identity where the nature of the request warrants it. There is generally no fee for submitting a rights request; however, CB NATIONAL reserves the right to charge a reasonable administrative fee for requests that are manifestly unfounded or excessive, particularly where they are repetitive in nature.

10.6 Limitations on Rights

Please note that certain data protection rights are not absolute and may be subject to lawful restrictions or exemptions. In particular, where the exercise of a requested right would conflict with CB NATIONAL's mandatory AML, CTF, or regulatory record-keeping obligations under applicable law, we may be unable to fulfill the request in full and will explain the basis for any limitation in our response.

11. AUTOMATED DECISION-MAKING AND PROFILING

CB NATIONAL employs automated screening tools as an integral and legally mandated component of our regulatory compliance program. These automated processes include sanctions list screening against internationally recognized watchlists, PEP database screening, adverse media screening, and AML risk scoring models used to determine a client's risk rating and the level of due diligence required.

These automated screening processes are required by law and form part of our financial crime prevention framework. They may produce outputs that affect our ability to onboard a client, maintain an existing client relationship, or execute a specific transaction.

Where a decision with legal or other significant effects on you is made through automated means, and where applicable data protection law grants you the right to request human review of that decision, you may exercise that right by contacting us in writing at Trade@CBNational.com. We will review such requests promptly and respond within the timeframe required by applicable law, providing you with an explanation of the decision and the opportunity to make representations. CB NATIONAL maintains appropriate human oversight of all significant automated compliance determinations.

12. COOKIES AND TRACKING TECHNOLOGIES

CB NATIONAL uses cookies and similar tracking technologies on our Website to support core functionality, measure performance, enhance the user experience, and where applicable support our marketing and analytics activities.

12.1 What Are Cookies

Cookies are small text files placed on your device by your web browser when you visit a website. They enable the website to recognize your device on subsequent visits, remember certain preferences and settings, and collect usage data to support the operation and improvement of the Website.

12.2 Categories of Cookies We Use

Strictly Necessary Cookies are essential for the fundamental operation of our Website. They enable you to navigate our pages, access secure areas, and use core features. Without these cookies, essential functions of the Website cannot be provided. These cookies cannot be disabled through our consent management tool, as they are technically required for the Website to function.

Performance and Analytics Cookies collect information about how visitors use our Website, including which pages are visited most frequently, how long visitors spend on each page, and whether they encounter any error messages. This information is used in aggregated and anonymized form to improve the performance and usability of our Website. We may use third-party analytics providers, including Google Analytics, for this purpose.

Functional Cookies enable our Website to remember choices you make, such as your preferred language, login status, and other personalization settings, to provide you with a more tailored and consistent experience.

Marketing and Targeting Cookies may be placed by CB NATIONAL or authorized third-party advertising platforms to track your browsing activity across websites and to deliver content and advertisements that are more relevant to your professional interests. These cookies are only placed with your prior consent.

Third-Party Cookies may be set by authorized third parties whose services are embedded on our Website, such as analytics providers, social media platforms, and market data services. The placement and use of such cookies is governed by the respective third party's cookie and privacy policies.

12.3 How Long Cookies Are Retained

Session cookies are temporary and are deleted from your device when you close your browser. Persistent cookies remain on your device for a defined period specified in the cookie itself or until you delete them manually through your browser settings. The retention period for each cookie category is detailed in our Cookie Policy, which is available on our Website.

12.4 Managing Your Cookie Preferences

Upon your first visit to our Website, you will be presented with a cookie consent management tool that allows you to review the categories of cookies used and to provide or withhold your consent for non-essential cookie categories. You may update your preferences at any time by accessing the cookie settings tool on our Website.

You may also manage, restrict, block, or delete cookies at any time through your browser settings. Instructions for managing cookies in popular browsers are available in each browser's help documentation. Please note that restricting or disabling certain categories of cookies may affect the functionality, performance, or personalization features of our Website.

For more detailed information about the specific cookies used on our Website, their purpose, provider, and retention period, please refer to our full Cookie Policy available at CBNational.com.

13. SECURITY OF YOUR PERSONAL DATA

CB NATIONAL treats the security of your personal data as a matter of the highest importance. We have implemented a comprehensive and layered set of technical, administrative, organizational, and physical safeguards designed to protect personal data from unauthorized access, accidental loss, unlawful alteration, improper disclosure, and all other forms of unauthorized processing.

Our information security measures include advanced encryption of all data in transit using industry-standard TLS protocols and of all data at rest using AES-256 encryption, multi-factor authentication requirements for all authorized user access to systems and environments containing personal data, role-based access controls and least-privilege access principles ensuring that personal data is accessible only to staff with a genuine operational need, network segmentation and perimeter security controls including firewalls and intrusion detection and prevention systems, regular independent penetration testing and vulnerability assessments conducted by qualified security professionals, continuous security monitoring and automated alerting for suspicious activity, formal security incident detection, classification, response, escalation, and notification protocols, staff training and awareness programs on data protection, information security, and phishing prevention, rigorous due diligence and contractual data protection obligations imposed on all third-party service providers who access personal data, and physical security controls at all locations where personal data is stored or processed.

While CB NATIONAL implements all reasonable precautions to protect your personal data, no method of electronic transmission or digital storage is completely immune to security risk. In the event of a personal data breach that poses a risk to your rights and freedoms, CB NATIONAL will take immediate and appropriate remedial action, notify the relevant data protection supervisory authority within the timeframe required by applicable law, and where required, notify affected individuals in a timely and transparent manner.

14. DATA BREACH NOTIFICATION

In the event that CB NATIONAL identifies a personal data breach, we will follow our formal incident response protocol, which includes immediate containment and assessment of the breach, notification to the Office of the Privacy Commissioner for Personal Data (Hong Kong) and other relevant supervisory authorities within the timeframes prescribed by applicable law, individual notification to affected clients where the breach poses a high risk to their rights and freedoms, and documentation of all breach incidents and response actions in our internal breach register as required by applicable data protection legislation.

We encourage clients to promptly notify us at Trade@CBNational.com if they suspect any unauthorized access to or misuse of their CB NATIONAL account or personal data.

15. CHILDREN'S PRIVACY

The Website and all CB NATIONAL Services are intended exclusively for adults aged 18 years and above. CB NATIONAL does not knowingly solicit, collect, or process personal data from individuals under the age of 18. Our onboarding process requires all clients to confirm that they are adults of legal age to enter into binding contracts in their jurisdiction.

If you are the parent or legal guardian of a minor and you believe that your child has provided personal data to CB NATIONAL without your consent, please contact us immediately at Trade@CBNational.com. Upon verification, we will take prompt and appropriate action to delete such data from our records and terminate any associated account.

16. MARKETING COMMUNICATIONS AND OPT-OUT

CB NATIONAL may, with your prior consent where required by applicable law, contact you with market intelligence publications, precious metals research and analysis, bullion price updates, new product and service announcements, industry event invitations, and other relevant professional communications related to the global precious metals market and our Services.

We will not send you unsolicited marketing communications. All marketing emails will clearly identify CB NATIONAL as the sender and will include a clearly visible and functional unsubscribe mechanism.

You may withdraw your consent to and opt out of receiving marketing communications from CB NATIONAL at any time by clicking the unsubscribe link included in any marketing email we send you, by updating your communication preferences through your client account portal where available, or by submitting a written opt-out request to Trade@CBNational.com.

We will process all opt-out requests as promptly as reasonably practicable, and in any event within ten business days of receipt. Please note that opting out of marketing communications will not affect your receipt of service notifications, account management communications, trade confirmations, compliance-related notices, or any other communications that are necessary for the administration of your account or the fulfillment of our legal obligations.

17. THIRD-PARTY WEBSITES AND EXTERNAL LINKS

Our Website may from time to time contain hyperlinks to third-party websites, partner platforms, market data providers, industry publications, or social media platforms. Such links are provided solely for informational convenience and do not constitute an endorsement by CB NATIONAL of the linked website, its content, or its operator.

CB NATIONAL has no control over and accepts no responsibility for the content, privacy practices, data handling procedures, or terms of service of any external website or platform. The collection and use of your personal data by any third-party website is governed exclusively by that party's own privacy policy. We strongly encourage you to review the privacy policies and terms of service of any third-party websites you access through links on our Website before submitting any personal information.

18. SOCIAL MEDIA AND PROFESSIONAL PLATFORMS

CB NATIONAL may maintain official profiles and pages on professional and social media platforms for corporate communications and industry engagement purposes. Any personal data you share with CB NATIONAL through such platforms is subject to the privacy policies and data practices of the respective platform provider. To the extent that CB NATIONAL receives or processes personal data obtained through social media or professional platform interactions, such data is handled in accordance with this Privacy Policy.

CB NATIONAL does not endorse and accepts no responsibility for the privacy or data practices of any third-party social media or professional networking platform.

19. CHANGES TO THIS PRIVACY POLICY

CB NATIONAL reserves the right to update, amend, or revise this Privacy Policy at any time to reflect changes in our business practices, the Services we offer, the technology we use, or the legal and regulatory environment applicable to our operations.

Any material changes to this Policy will be communicated by posting a clearly prominent notice on our Website, by updating the "Effective Date" and "Last Updated" fields at the top of this document, and where appropriate by direct notification to clients affected by the changes via the email address registered to their account.

We encourage you to review this Privacy Policy periodically to remain informed of how we collect, use, and protect your personal data. Your continued access to our Website or engagement with our Services following the publication of any updated Privacy Policy constitutes your acknowledgment of the changes and your acceptance of the revised terms to the extent permitted by applicable law.

20. CONTACT US, COMPLAINTS, AND SUPERVISORY AUTHORITIES

If you have any questions, concerns, clarification requests, or formal requests regarding this Privacy Policy, our data collection and processing practices, or the exercise of any of your data protection rights, please contact our Data Protection Officer through the following channels.

CB NATIONAL
Attn: Data Protection Officer
[Registered Company Address Placeholder]
Hong Kong Special Administrative Region
People's Republic of China
Email: Trade@CBNational.com

CB NATIONAL is committed to resolving all data protection enquiries, complaints, and rights requests fairly, transparently, and within the timeframes required by applicable law. We will acknowledge receipt of your communication promptly and provide a substantive response as quickly as reasonably practicable.

If you are not satisfied with the manner in which CB NATIONAL has handled your personal data or with our response to a complaint or rights request, you have the right to escalate your concern to the relevant data protection supervisory authority in your jurisdiction.

For clients and data subjects in Hong Kong, the relevant supervisory authority is the Office of the Privacy Commissioner for Personal Data (PCPD), whose contact details and complaint procedures are available at www.pcpd.org.hk.

For clients and data subjects within the European Economic Area, the relevant supervisory authority is the national data protection authority of your country of residence or establishment. A full directory of EEA supervisory authorities is maintained by the European Data Protection Board at edpb.europa.eu.

For clients and data subjects in the United Kingdom, the relevant supervisory authority is the Information Commissioner's Office (ICO), whose contact details are available at ico.org.uk.

For clients and data subjects in California, the relevant authority is the California Privacy Protection Agency (CPPA), whose contact details are available at cppa.ca.gov.

21. REGULATORY CONTEXT AND GOVERNING LAW

This Privacy Policy is governed by and construed in accordance with the laws of the Hong Kong Special Administrative Region, People's Republic of China. CB NATIONAL's personal data processing activities are conducted in compliance with the Personal Data (Privacy) Ordinance (Cap. 522) and its subsidiary legislation, the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) and all applicable regulatory guidelines issued by the Hong Kong Monetary Authority, the Financial Services and the Treasury Bureau, and other relevant competent authorities, applicable provisions of the General Data Protection Regulation (EU) 2016/679 where CB NATIONAL processes personal data of EEA data subjects, applicable provisions of the UK GDPR and Data Protection Act 2018 where CB NATIONAL processes personal data of UK data subjects, applicable provisions of the California Consumer Privacy Act and California Privacy Rights Act where CB NATIONAL processes personal data of California residents, and all other applicable international data protection legislation relevant to CB NATIONAL's global operations and client base.

Any disputes arising from or in connection with this Privacy Policy that cannot be resolved through direct correspondence with CB NATIONAL shall be subject to the non-exclusive jurisdiction of the courts of the Hong Kong Special Administrative Region.

This Privacy Policy was prepared in accordance with the requirements of the Personal Data (Privacy) Ordinance (Cap. 522) of Hong Kong, the General Data Protection Regulation (EU) 2016/679, the California Consumer Privacy Act as amended by the California Privacy Rights Act, and applicable international data protection standards. It is intended as a comprehensive transparency document for all individuals interacting with CB NATIONAL and its Services. CB NATIONAL recommends that all clients obtain independent legal advice regarding their data protection rights and obligations in their respective jurisdictions.