Privacy Policy

XCA Management ("we", "our", or "us") is committed to protecting your personal and financial information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our financial and investment services, website, and related platforms (collectively, the "Services").

By accessing or using our Services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please discontinue use of our Services.

We are committed to complying with all applicable privacy and data protection laws, including those governing financial services. We encourage you to read this policy carefully and contact us if you have any questions.

We collect several categories of information to provide and improve our Services:

Personal Identification Information

Full name, date of birth, government-issued identification numbers (e.g. passport, driver's licence), residential address, email address, phone number, and signature.

Financial Information

Bank account details, tax file numbers, investment history, transaction records, income and asset information, and details required to verify your status as a wholesale investor under applicable Australian financial services law.

Usage and Technical Data

IP address, browser type and version, device identifiers, pages visited, time spent on pages, links clicked, referring URLs, and other diagnostic data collected automatically when you interact with our Services.

Communications Data

Records of correspondence with us, including emails, chat transcripts, and call recordings where permitted by law, as well as your preferences for receiving communications from us.

We use the information we collect for the following purposes:

• Account Management: To create, maintain, and manage your account, verify your identity, and provide access to our Services.
• Investment Services: To provide information about our investment funds, process applications, manage fund operations, and communicate with you regarding your investment. We do not provide personal financial advice — investors should obtain independent financial advice before making any investment decision.
• Legal and Regulatory Compliance: To meet our obligations under applicable financial services laws, anti-money laundering (AML) and counter-terrorism financing (CTF) legislation, tax reporting requirements, and other regulatory frameworks.
• Communications: To send account statements, transaction confirmations, service updates, and — where you have opted in — marketing communications about products and services that may be of interest to you.
• Security and Fraud Prevention: To detect, investigate, and prevent fraudulent transactions, unauthorised access, and other illegal activities.
• Service Improvement: To analyse usage patterns, conduct research, and improve the functionality, performance, and user experience of our Services.

We do not sell your personal information. We may share your information in the following circumstances:

• Regulatory Bodies: We may disclose information to financial regulators, government agencies, tax authorities, and law enforcement bodies as required by law or regulation.
• Service Providers: We engage trusted third-party providers (e.g. custodians, technology platforms, identity verification services, payment processors) who assist us in delivering our Services. These parties are contractually bound to protect your information and use it only for the purposes we specify.
• Legal Requirements: We may disclose information where required by a court order, subpoena, or other legal process, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the relevant successor entity, subject to the same privacy protections.
• With Your Consent: We may share your information with third parties when you have given us explicit consent to do so.

We take the security of your information seriously and implement industry-standard technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption: All data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security). Sensitive data at rest is encrypted using AES-256 or equivalent standards.
• Access Controls: Access to your personal and financial information is restricted to authorised personnel on a need-to-know basis, and is protected by multi-factor authentication.
• Security Monitoring: We continuously monitor our systems for suspicious activity and conduct regular security assessments and penetration testing.
• Incident Response: We maintain a data breach response plan and will notify you and relevant authorities in the event of a breach as required by law.

While we strive to protect your information, no method of transmission over the internet or electronic storage is completely secure. We encourage you to use strong, unique passwords and to contact us immediately if you suspect any unauthorised access to your account.

We retain your personal and financial information for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting, and reporting requirements.

Financial services regulations typically require us to retain client records for a minimum of seven (7) years following the end of our relationship with you. In some cases, longer retention periods may apply depending on the nature of the information and applicable law.

When your information is no longer required, we will securely delete or anonymise it in accordance with our data retention schedule.

Subject to applicable law, you may have the following rights regarding your personal information:

• Access: The right to request a copy of the personal information we hold about you.
• Correction: The right to request that we correct inaccurate or incomplete information.
• Deletion: The right to request deletion of your personal information, subject to our legal and regulatory obligations to retain certain records.
• Portability: The right to receive your personal information in a structured, commonly used, machine-readable format and to transmit it to another service provider.
• Objection: The right to object to certain processing of your information, including direct marketing.
• Restriction: The right to request that we restrict processing of your information in certain circumstances.

To exercise any of these rights, please contact us using the details in the "Contact Us" section below. We will respond to your request within the timeframe required by applicable law.

We use cookies and similar tracking technologies to enhance your experience on our platform, analyse usage, and deliver relevant content. Cookies are small text files stored on your device.

We use the following types of cookies:

• Essential Cookies: Required for the operation of our Services, including authentication and security features. These cannot be disabled.
• Analytics Cookies: Help us understand how visitors interact with our platform so we can improve performance and usability.
• Preference Cookies: Remember your settings and preferences to personalise your experience.
• Marketing Cookies: Used to deliver relevant advertisements and track the effectiveness of our marketing campaigns, where you have consented.

You can manage your cookie preferences through your browser settings or our cookie consent tool. Please note that disabling certain cookies may affect the functionality of our Services.

Our Services may contain links to third-party websites, applications, or services. This Privacy Policy does not apply to those third-party platforms, and we are not responsible for their privacy practices.

We encourage you to review the privacy policies of any third-party services you access through our platform before providing them with your personal information.

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a person under 18, please contact us immediately and we will take steps to delete that information.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by updating the "Last Updated" date at the top of this page and, where appropriate, by sending you a direct notification.

We encourage you to review this Privacy Policy periodically. Your continued use of our Services after any changes constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy Officer:

We aim to respond to all privacy-related enquiries within 30 days. If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection or financial services regulator in your jurisdiction.