Privacy Policy

1. Introduction and Data Controller

Undercurrent Holdings LLC (“Undercurrent,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our websites and services, including our investor portal at investors.undercurrentholdings.com (the “Portal”).

Data Controller:
Undercurrent Holdings LLC
Wyoming, United States
Email: privacy@undercurrentholdings.com

2. What Data We Collect

We collect information to provide our services and comply with legal obligations:

Account Data

When you create an account, we collect information you provide such as your name, email address, and contact information. For investment-related services, we may also collect identity verification information, accreditation status, and tax identification information as required by law.

Transaction Data

Records of your investment activities, subscription documents, and communications related to your investments accessed through our Portal.

Event Data

Navigation patterns, button clicks, and interaction events within our platforms. This helps us understand how you use our services and identify areas for improvement.

Session Data

Session duration, start time, and end time. This helps us understand usage patterns and optimize performance.

Technical Data

Browser type, device information, IP address (which may be anonymized for analytics purposes), and referrer information. This is used for security, fraud prevention, and understanding access patterns.

3. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract Performance: Processing necessary to provide our services, including account management, investment administration, and electronic delivery of documents.
• Legal Obligation: Processing required to comply with securities laws, tax reporting requirements, anti-money laundering regulations, sanctions screening, and recordkeeping obligations.
• Legitimate Interests: Processing for fraud prevention, security, service improvement, and communications with existing users (with appropriate safeguards and opt-out rights).
• Consent: Where required by law, particularly for certain marketing communications and analytics cookies.

4. Why We Collect It

We use the information we collect to:

• Provide, maintain, and improve our services;
• Verify your identity and accreditation status as required by securities laws;
• Process and administer your investments;
• Deliver electronic documents, tax forms, and investor communications;
• Communicate with you about updates, security alerts, and support;
• Detect, prevent, and address fraud, security threats, and technical issues;
• Comply with legal obligations, including regulatory reporting and recordkeeping;
• Respond to legal process and regulatory inquiries;
• Enforce our Terms of Service and protect our rights.

5. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Right to Access

You can request a copy of all personal data we have collected about you, the sources of that information, our purposes for collecting it, and the categories of third parties with whom we share it.

Right to Deletion

You can request that we delete your personal data, subject to legal retention requirements. Important: Securities regulations and tax laws may require us to retain certain records regardless of deletion requests. We will inform you if legal retention requirements prevent deletion.

Right to Correction

You can request that we correct any inaccurate personal data we hold about you.

Right to Withdraw Consent

Where processing is based on consent, you can withdraw consent at any time. This does not affect the lawfulness of processing before withdrawal.

Right to Data Portability

You may request to receive your data in a structured, commonly used, machine-readable format.

Right to Non-Discrimination

We will not discriminate against you for exercising your privacy rights.

How to Exercise Your Rights: Submit requests to privacy@undercurrentholdings.com. Include your full name, account email, and a description of your request. We may require identity verification before processing requests. We will respond within 30-45 days as required by applicable law.

6. Data Retention

We retain personal data for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, and protect our legitimate interests.

• Analytics data: 90 days, then automatically deleted or anonymized.
• Account data: Duration of account plus 7 years after account closure (to comply with tax and regulatory requirements).
• Investment records: Life of investment plus 7 years (legal and tax compliance).
• Accreditation verification: Life of investment plus 6 years (securities law compliance).
• Communications: 6 years (litigation and regulatory defense).

These retention periods may be extended if required by law, ongoing litigation, or regulatory inquiry.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data at rest and in transit, access controls, multi-factor authentication, regular security assessments, and employee training. While we strive to protect your data, no method of transmission over the Internet or electronic storage is completely secure.

8. Third-Party Services

We use trusted third-party services to help provide our services:

• Authentication: We use Clerk for secure user authentication.
• Cloud Infrastructure: We use industry-leading cloud providers for hosting and data storage.
• Analytics: We use privacy-focused analytics to understand usage patterns.

These providers are contractually bound to protect your data, use it only for the purposes we specify, and comply with applicable data protection laws.

9. International Data Transfers

Your personal data may be transferred to and processed in the United States and other countries outside your country of residence.

For transfers from the European Economic Area, United Kingdom, or Switzerland, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Supplementary technical measures including encryption and access controls;
• Data processing agreements with our service providers.

You may request a copy of applicable transfer mechanisms by contacting privacy@undercurrentholdings.com.

10. Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience:

• Essential Cookies: Required for our services to function (authentication, security, preferences). These cannot be disabled.
• Analytics Cookies: Help us understand usage patterns and improve our services. You can control these through your browser settings.

We do not sell your personal information or share it for cross-context behavioral advertising.

11. Data Breach Notification

In the event of a security breach involving your personal information that triggers notification requirements under applicable law, we will notify you in accordance with such requirements. Notification may be provided via email to the address in your account, via the Portal, by mail, or through other means permitted by applicable law. For breaches affecting EU/UK residents, we will notify relevant supervisory authorities within 72 hours as required by GDPR.

12. US State Privacy Rights

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, or other states with comprehensive privacy laws, you may have additional rights including:

• Right to know what personal information is collected and how it is used;
• Right to delete personal information (subject to legal exceptions);
• Right to correct inaccurate personal information;
• Right to opt out of “sales” or “sharing” of personal information (we do not sell your data);
• Right to appeal denied requests.

To exercise these rights, contact privacy@undercurrentholdings.com.

13. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us, and we will take steps to delete such information.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the “Effective Date” above. For material changes, we will provide at least 30 days' notice via email or through the Portal. Your continued use of our services after the effective date constitutes acceptance of the updated policy.

15. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your rights, or have concerns about our data practices, please contact us:

Undercurrent Holdings LLC
Email: privacy@undercurrentholdings.com

If you are in the European Economic Area and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.