Privacy Policy

This Privacy Policy explains how NAMH Global Ltd(“NAMH”, “we”) collects, uses, protects, and shares your personal data. We are the data controller for the purposes of applicable data protection law.

Our approach is built on GDPR-aligned principles regardless of jurisdiction: data minimisation, purpose limitation, accuracy, retention limits, and user rights.

Identity & verification

• Full name, date of birth, nationality, residential address.
• Government ID (passport, driving licence, national ID).
• Selfie for biometric matching.
• Proof of funds (for high-value deposits only).

Contact information

• Email address, phone number.
• Emergency / beneficiary contact (optional).

Financial information

• Trading account balance, positions, and history.
• Deposit and withdrawal history.
• Payment method metadata (last 4 digits of cards, bank account references).

Technical data

• IP address, device type, browser, operating system.
• Login timestamps, session durations, platform activity.
• Cookies and similar technologies (see our Cookie Policy).

We process personal data only for specific, legitimate purposes:

• Service delivery: opening your account, executing trades, processing deposits/withdrawals.
• Legal compliance: AML/KYC verification, sanctions screening, transaction monitoring, regulatory reporting.
• Security: fraud prevention, account protection, incident response.
• Communication: service updates, trade confirmations, support replies, required legal notices.
• Improvement: aggregated analytics to improve the platform (no individual tracking for marketing).
• Marketing (optional): only with your explicit opt-in consent, and you can withdraw consent at any time.

Where GDPR applies, we rely on these legal bases:

• Contract: processing necessary to provide the services you signed up for.
• Legal obligation: AML, tax reporting, regulatory requirements.
• Legitimate interests: fraud prevention, security, platform improvement (balanced against your rights).
• Consent: marketing communications, optional analytics cookies.

Your data is shared only with trusted parties essential to providing our services:

• Liquidity providers and banking partners — for trade execution and settlement.
• Payment processors — card networks, bank rails, crypto nodes for deposit/withdrawal processing.
• KYC / AML service providers — identity verification and sanctions screening.
• Regulators and law enforcement — when legally required to disclose.
• Cloud and IT infrastructure providers — with strict data-processing agreements in place.

We never sell your data to third parties for marketing purposes.

Data is stored on encrypted infrastructure hosted with tier-1 cloud providers. In transit, we use TLS 1.3. At rest, data is encrypted with AES-256.

Access controls

• Role-based access to personal data — only staff with a legitimate business need.
• Multi-factor authentication mandatory for all internal systems.
• Audit logs on all access to sensitive data.

Incident response

In the unlikely event of a data breach affecting you, we notify you and the relevant authorities within 72 hours as required by GDPR, and provide clear guidance on any steps you should take.

We retain data only as long as needed for the purpose collected:

• Active account data: retained while your account is open.
• Trading records: 5–7 years post-account-closure (regulatory requirement).
• KYC records: 5 years post-account-closure (AML requirement).
• Marketing data: until you withdraw consent or opt out.
• Technical logs: 90 days for routine activity, 12 months for security events.

After retention periods expire, data is securely destroyed or fully anonymised.

Subject to local law, you have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion (subject to legal retention obligations).
• Restriction: limit how we use your data in certain circumstances.
• Portability: receive your data in a machine-readable format.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: for any processing based on consent.
• Complain: to your local data protection authority.

Submit requests to dpo@namhglobal.com. We respond within 30 days.

Some of our service providers may be located outside your country of residence. When transferring data internationally, we use:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable.
• Only providers in jurisdictions with adequate data protection regimes, or with additional safeguards.
• Data minimisation — only the data necessary for the specific purpose.

NAMH services are strictly for adults (18+). We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, please contact dpo@namhglobal.com immediately.

We may update this Privacy Policy to reflect operational, legal, or regulatory changes. Material changes will be notified to account holders via email at least 14 days before taking effect. The latest version is always published on this page with an updated version number and date.

Data protection queries and rights requests:

• Email: dpo@namhglobal.com
• Postal: NAMH Global Ltd, Saint Lucia (full address on request)
• Phone: +1-758-461-4088