This Privacy Policy governs the collection, use, storage, disclosure, and protection of your personal data by Halan for Technology and Services ("we", "us", or "our") through the HalanSB mobile trading application (the "Application"). It is issued in compliance with the Egyptian Data Protection Law No. 151 of 2020, FRA licensing requirements, and applicable capital markets regulation.

As a licensed financial intermediary supervised by the FRA, we are subject to mandatory obligations regarding customer identification, transaction recordkeeping, and reporting to regulatory authorities. This policy explains how these obligations affect your data.

Section 1Information we collect

1.1 Identity and KYC information (mandatory under Egyptian AML Law No. 80/2002 and FRA rules)

We are legally required to collect and verify your identity before activating trading access. This includes:

• Full legal name (as on official ID), date of birth, nationality, and place of birth
• National ID (National Number / الرقم القومي) for Egyptian nationals, or passport / residence permit for non-nationals
• Tax Identification Number (TIN / الرقم الضريبي) as required for tax reporting to the Egyptian Tax Authority (ETA)
• Proof of address (utility bill, bank statement, or equivalent document issued within 3 months)
• Source of funds and source of wealth declarations
• Employer / business activity information where required for enhanced due diligence

1.2 Financial and trading information

• Bank account and payment details (for deposits and withdrawals via regulated Egyptian bank channels)
• Trading history: orders placed, executed trades, cancellations, and portfolio positions
• Transaction records: trade confirmations, account statements, margin calls, and settlement records
• Suitability and appropriateness assessment responses (investment experience, risk tolerance, financial objectives)
• Account balance, margin, and credit exposure information

1.3 Information you provide voluntarily

• Email address, mobile number, and account credentials
• Support communications and in-app messages
• Survey responses and feedback

1.4 Information collected automatically

• Device type, model, and unique device identifier (Device ID)
• IP address and geolocation data
• Mobile operating system and version
• Session data: login times, navigation patterns, feature usage
• Order entry behavior (used for fraud and market manipulation detection)

Section 2Purposes of processing and legal bases

2.1 Providing trading and brokerage services

We process your data to open and manage your trading account, execute and settle trades, process payments, and provide market data and portfolio information.

2.2 Regulatory compliance and mandatory reporting

As a licensed FRA entity, we are legally required to:

• Conduct KYC verification and ongoing customer due diligence (AML Law No. 80/2002)
• Screen customers against the Egyptian and international sanctions lists, and PEP databases
• Report suspicious transactions to the Egyptian Money Laundering Combating Unit (EMLCU) — such reports may be made without notifying you, as required by law
• Submit transaction reports and client data to the FRA upon request or as required by FRA supervision rules
• Report account and income data to the Egyptian Tax Authority (ETA) as required under the Income Tax Law No. 91/2005 and FRA tax reporting directives
• Conduct and document suitability assessments before providing access to complex instruments (FRA rules on investor protection)

2.3 Fraud prevention and market integrity

• Monitoring for unauthorized account access, identity fraud, and unusual transaction patterns
• Detecting potential market abuse, insider trading, or market manipulation (reportable to FRA under Capital Market Law No. 95/1992, Art. 64)
• Enforcing our Terms of Service

2.4 Personalization and AI-powered features

• Personalizing market insights, alerts, and instrument recommendations based on trading history and preferences
• Improving Application performance through aggregated analytics

2.5 Marketing communications

With your explicit, separate consent, we may send you information about new features, products, and market updates. You may withdraw this consent at any time (see Section 13).

Section 3Know Your Customer (KYC) and Anti-Money Laundering (AML)

In compliance with Egyptian AML Law No. 80 of 2002 and its amendments, and FRA AML guidelines, we apply a risk-based approach to customer due diligence including:

• Standard due diligence (SDD) for regular retail customers
• Enhanced due diligence (EDD) for high-risk customers, PEPs, and customers from high-risk jurisdictions
• Ongoing monitoring of transactions and periodic re-verification of customer information
• Filing of Suspicious Transaction Reports (STRs) with EMLCU where required by law

Section 4Financial data and payment processing

All deposits and withdrawals must be processed through licensed Egyptian banks or payment service providers regulated by the Central Bank of Egypt (CBE). We do not accept cash transactions or transfers from unverified sources.

Payment data is processed in accordance with CBE payment system regulations and PCI DSS standards. We do not store full card numbers on our systems.

Transaction records are retained for the minimum period required by Egyptian law (see Section 11 for the retention schedule).

Section 5Third-party data sharing

We do not sell your personal data. Disclosure occurs only as described below.

5.1 Mandatory regulatory disclosures (Egyptian authorities)

• Financial Regulatory Authority (FRA): supervisory inspection, investigation, or market surveillance
• Egyptian Money Laundering Combating Unit (EMLCU): suspicious transaction reports
• Egyptian Tax Authority (ETA): income, capital gains, and withholding tax reporting
• Misr for Central Clearing, Depository and Registry (MCDR): settlement and registry of securities
• Egyptian Exchange (EGX): trade data as required for market operations
• Egyptian courts, prosecutors, or law enforcement: pursuant to lawful order or investigation

5.2 Service providers (data processors)

We share data with trusted third-party processors who act on our instructions, are contractually bound to this policy, and may not use data for their own purposes:

• KYC / identity verification providers
• CBE-licensed payment processors and banking partners
• Market data and liquidity providers
• Cloud hosting and infrastructure providers
• Customer support platforms

AI Assistant Connector recipients: currently OpenAI and Anthropic, plus any other AI platform or custom Model Context Protocol (MCP) endpoint you personally choose to connect (see Section 8).

5.3 Analytics and infrastructure partners

• Firebase Crashlytics — crash reporting and diagnostics
• Mixpanel — product analytics
• Adjust — mobile measurement

Section 6Location data

The Application collects device location for:

• Regulatory compliance: verifying access from a permitted jurisdiction, as certain instruments may be restricted to Egyptian residents or specific investor categories under FRA rules
• Fraud prevention: detecting access from unusual or high-risk locations
• Service personalization: delivering Egypt-relevant market data, EGX listings, and local features

You may revoke location permissions in your device settings at any time. This may restrict access to certain features or, in some cases, trading activity where jurisdiction verification is required by FRA regulations.

Section 7Artificial Intelligence (AI) and automated decision-making

The Application uses AI and automated systems for:

• Personalized market insights, EGX stock recommendations, and portfolio analytics
• Automated alerts for price movements, margin calls, and account thresholds
• Fraud and market abuse detection through pattern analysis of trading activity
• Suitability assessment support to help match products to your investor profile

Automated decisions with significant effects: our systems may automatically restrict account access (for example, when suspicious activity is detected) or flag accounts for manual review. Under the Egyptian Data Protection Law No. 151 of 2020 (Art. 15), you have the right to:

• Be informed when a significant decision is made about you solely by automated means
• Request human review of any such automated decision
• Express your objection and contest the outcome

Note: certain automated blocks required by law (for example, sanctions screening) may not be subject to human override. Contact info@halansb.com to exercise your rights regarding automated decisions.

Section 8AI Assistant Connectors and third-party AI platforms

8.1 What this section covers

Where enabled, the Application may offer a connector, plugin, or comparable integration ("Connector") that allows you to access limited account information from within a third-party conversational AI platform. We currently integrate with OpenAI's ChatGPT and Anthropic's Claude, and you may also choose to connect the Connector to a custom Model Context Protocol (MCP) endpoint or another AI platform of your own selection (each, together with ChatGPT and Claude, an "AI Platform") — at your own initiation. This section explains what data the Connector shares, with whom, and how you remain in control of it. It supplements, and does not replace, the other sections of this Policy, which continue to apply to all data collected through the Application itself.

8.2 Categories of data shared through the Connector

When you use the Connector, we share only the following categories of data with the AI Platform, and only in response to a specific request you make within that platform:

• Portfolio holdings — the stocks you own and their current prices
• Live / real-time stock price data

We do not share any data through the Connector beyond what is listed above.

8.3 Data that is never shared through the Connector

Regardless of Connector scope, the following categories of data are never made available to any AI Platform, under any circumstance:

• National ID number, passport number, or other government-issued identifiers
• Tax Identification Number (TIN)
• Proof-of-address documents
• Source of funds / source of wealth declarations
• Employer or business activity information
• Biometric or liveness-verification data collected during EKYC
• Full bank account or card numbers
• Account credentials, passwords, or multi-factor authentication (MFA) / one-time-password (OTP) codes

8.4 Purpose and legal basis

Data is shared through the Connector solely to fulfil the specific request you make to the AI Platform for information about your own account. We do not use the Connector to profile you, to market to you, or for any purpose beyond responding to your request. Processing is based on your explicit consent (Data Protection Law No. 151/2020, Art. 9), which you give by enabling the Connector, and which you may withdraw at any time without affecting the lawfulness of prior processing.

8.5 Recipients and cross-border transfer

OpenAI and Anthropic act as independent recipients of the data described in Section 8.2 once it is shared through the Connector, and process it in accordance with their own privacy policies, available at openai.com/policies/privacy-policy and anthropic.com/legal/privacy respectively. Where this involves a transfer of personal data outside Egypt, we rely on the safeguards described in Section 14 of this Policy (Cross-border data transfers).

Where you choose to connect the Connector to a custom MCP endpoint or an AI platform other than OpenAI or Anthropic, that party — not us — determines how it handles the data you choose to share, in accordance with its own privacy practices. We have not reviewed and cannot vouch for the data practices of platforms we do not name above; connecting the Connector to such an endpoint is done entirely at your own initiation and discretion.

We retain no copy of the data shared through the Connector beyond what is necessary to service the specific request; retention of that data by the AI Platform itself is governed by the AI Platform's own policy, not by us.

8.6 Your controls

The Connector is opt-in only and is enabled and managed on the AI Platform's side, not within the Application itself: in ChatGPT, under Settings > Connectors; in Claude, under Settings > Connectors.

• You may disable the Connector at any time from that same AI Platform settings menu, which immediately stops any further sharing.
• Disabling the Connector does not affect your ability to use the Application directly.

8.7 Order-related functionality operates on a draft basis only

Where the Connector offers any order-related functionality, it operates on a draft basis only: information exchanged through the Connector may be used to prepare a proposed order for your review, but no order is submitted, modified, or cancelled without your separate, explicit confirmation completed directly within the Application. All trading and transactional decisions therefore remain subject to your affirmative action, and to the same KYC, AML, suitability, and FRA supervisory obligations described elsewhere in this Policy. Use of the Connector does not waive or bypass any such obligations, including jurisdiction or eligibility verification.

8.8 Not investment advice

Any market commentary, portfolio summary, or analysis generated by an AI Platform in response to Connector data is generated by that AI Platform, not by us, and does not constitute investment advice, a recommendation, or a suitability assessment from Halan. Section 16 of this Policy (Consumer protection) and our suitability assessment obligations apply only to advice and assessments we provide directly.

8.9 Changes to Connector data practices

If we expand the scope of data shared through the Connector, add a new AI Platform, or otherwise materially change the practices described in this section, we will update this Policy and, where required by Egyptian law or FRA rules, seek your fresh consent before the change takes effect, consistent with Section 18 of this Policy.

Section 9Advertising, tracking, and App Tracking Transparency (iOS)

Some third-party analytics partners (including Mixpanel) may collect data used to track activity across apps and websites. On iOS 14.5 and later, we request permission before enabling such tracking via Apple's App Tracking Transparency (ATT) framework:

• If you grant permission: partners may use your data for cross-app analytics and relevant advertising
• If you deny permission: cross-app tracking will not occur; all core trading features remain available

Change your preference at any time under Settings > Privacy & Security > Tracking (iOS), or via Google settings > Ads (Android). Under the Egyptian Data Protection Law No. 151/2020, you have the right to withdraw consent for tracking at any time.

Section 10Security

Given the nature of financial data and FRA requirements for data security, we apply the following measures:

• TLS/HTTPS encryption for all data in transit between the Application and our servers
• Encryption of personal and financial data at rest using industry-standard algorithms
• Multi-factor authentication (MFA) for all account access
• Role-based access controls: data access restricted to authorized personnel on a need-to-know basis
• Continuous monitoring, intrusion detection, and anomaly alerting
• Regular penetration testing and independent security audits
• PCI DSS-compliant handling of payment card data
• Incident response procedures aligned with FRA cybersecurity guidance and Data Protection Law No. 151/2020 breach notification requirements
• AI Assistant Connector access: authorized through scoped, revocable access tokens (OAuth 2.1) issued for that specific integration only; these tokens are separate from, and never include, your account password or multi-factor authentication (MFA) codes, and can be revoked independently of your in-app credentials at any time (see Section 8.6)

In the event of a personal data breach that poses a risk to your rights, we will notify the Personal Data Protection Center (PDPC) and affected individuals within the timeframes required by the Data Protection Law No. 151/2020 and its Executive Regulations.

Section 11Data retention

Retention periods are governed by Egyptian law and FRA regulations:

• KYC and identity documents: minimum 5 years after account closure, in accordance with AML Law No. 80/2002 (Art. 19) and FRA AML guidelines
• Transaction and trading records: minimum 5 years from the date of each transaction, as required by Capital Market Law No. 95/1992 and FRA Decree No. 30/2002
• Suspicious transaction reports and related files: minimum 5 years (EMLCU requirements)
• Tax-related records: minimum 5 years as required by the Income Tax Law No. 91/2005
• Support communications related to trading: minimum 5 years
• Automatically collected device/usage data: up to 24 months, then aggregated and anonymized
• Marketing consent records: retained for the duration of consent plus a reasonable compliance evidence period

To request deletion of data not subject to mandatory retention, email info@halansb.com. We will respond within 15 business days as required by Data Protection Law No. 151/2020.

Section 12Your rights under Egyptian Data Protection Law No. 151/2020

The Egyptian Data Protection Law No. 151 of 2020 grants you the following rights:

• Right of access (Art. 10): obtain a copy of your personal data and information about how it is processed
• Right to rectification (Art. 11): request correction of inaccurate or incomplete data
• Right to erasure (Art. 12): request deletion of data we are not legally obligated to retain
• Right to restriction of processing (Art. 13): request that we suspend processing in certain circumstances
• Right to data portability (Art. 14): receive your data in a structured, readable format
• Right to object (Art. 16): object to processing for marketing purposes or where we rely on legitimate interest
• Right to withdraw consent (Art. 9): withdraw consent at any time without affecting prior lawful processing
• Right regarding automated decisions (Art. 15): request human review, express your view, and contest automated decisions with significant effects
• Right to lodge a complaint: file a complaint with the Personal Data Protection Center (PDPC / مركز حماية البيانات الشخصية)

To exercise any right, contact us at info@halansb.com or in writing at our registered address (see Section 19 for our registered addresses). We will respond within 15 business days as required by Data Protection Law No. 151/2020 and its Executive Regulations.

Section 13Opt-out and data control options

• Marketing emails: unsubscribe via the link in any marketing message, or contact info@halansb.com
• Push notifications: adjust in your device's notification settings
• Location data: revoke location permissions in your device settings
• iOS cross-app tracking (ATT): Settings > Privacy & Security > Tracking
• AI Assistant Connector: revoke access directly in the AI Platform's own settings (see Section 8.6)
• Close account: contact info@halansb.com — mandatory AML/FRA retention obligations continue to apply after closure
• Stop all data collection: uninstall the Application via your device's standard process

Section 14Cross-border data transfers

Under the Egyptian Data Protection Law No. 151 of 2020 (Art. 24–25), transfer of personal data outside Egypt requires one of the following:

• The destination country provides an adequate level of data protection as determined by the PDPC
• Appropriate safeguards are in place, such as standard contractual clauses approved by the PDPC
• The data subject has given explicit consent to the transfer
• The transfer is necessary for the performance of a contract to which you are a party

Some of our service providers (including cloud infrastructure and analytics partners) may process data outside Egypt. We ensure appropriate safeguards are in place for all such transfers in accordance with Data Protection Law No. 151/2020. For details about specific transfers and safeguards, contact info@halansb.com.

Section 15Children and investor eligibility

The Application is a licensed financial trading platform available only to individuals who are:

• At least 21 years of age (the Egyptian legal age of full civil capacity), or
• At least 18 years of age and legally emancipated, with documentation acceptable to FRA-regulated entities

We do not knowingly collect personal data from anyone below the applicable age threshold. If we become aware that an ineligible individual has registered, we will immediately close the account and delete associated data. Report any suspected underage registration to info@halansb.com.

Section 16Consumer protection

In accordance with Egyptian Consumer Protection Law No. 181 of 2018 and FRA investor protection rules, you have the right to:

• Receive clear, accurate, and non-misleading information about our services, fees, and risks
• Access full disclosure of all charges, commissions, and costs associated with your trading account
• File a complaint with us and escalate unresolved complaints to the FRA's investor complaint mechanism or the Consumer Protection Agency (CPA)
• Receive a suitability assessment before trading in complex or high-risk instruments

Section 17Platform-specific disclosures (Google Play / Apple App Store)

In addition to this policy, our data practices are summarized in:

• Google Play Data Safety section: consistent with this policy, covering data types collected, sharing practices, security measures, and user controls in Google's required format
• Apple App Store Privacy nutrition label: consistent with this policy, categorizing data under Apple's required labels (Data Used to Track You, Data Linked to You, Data Not Linked to You)

If you notice any inconsistency between this policy and a platform disclosure, contact info@halansb.com.

Section 18Changes to this Privacy Policy

We may update this policy to reflect changes in law, FRA regulations, or our practices. For material changes:

• We will post the updated policy with a revised effective date
• We will display a prominent in-app notice
• Where Egyptian law or FRA rules require fresh consent, we will seek it explicitly

Continued use of the Application after changes are posted constitutes acknowledgment of the updated policy, where consent is not separately required.

Section 19Contact us

Halan for Technology and Services
Mall of Arabia, Halan Gate 11, 6th of October City, Giza, Egypt
Email: info@halan.com

Halan Securities Brokerage (FRA-licensed brokerage entity operating the Application)
170 Road 28, 4th Floor, Apt. 9, Fifth Settlement, New Cairo, Egypt (Building in front of HSBC, Katameya Heights)
Email: info@halansb.com
FRA License No.: 25192