Privacy Policy

Gold Grain Capital Investments Ltd — Company No. 517387726
Last updated: 7 September 2026

1. Introduction

Gold Grain Capital Investments Ltd, company number 517387726 ("we", "us", "our"), is committed to protecting your privacy and your personal information. Any information relating to an identified or identifiable person is treated by us as personal information ("Personal Information").

This Privacy Policy explains what Personal Information we collect, how we use it, how we store and secure it, who we share it with, and what rights you have under Israeli law.

This Privacy Policy applies to our services and to our website at www.ggc.co.il.

We are a wholly owned subsidiary of ATYD Capital Ltd (England and Wales, company number 17339033). Some of our administrative, IT and compliance functions are performed by, or shared with, our holding company outside Israel — see section 12 below.

2. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The version published on our website is the current one, and we encourage you to review it when you interact with us.

3. Legal framework

We collect and process Personal Information in accordance with:

• the Protection of Privacy Law, 5741-1981 (the "PPL"), as amended, including by Amendment No. 13 which entered into force on 14 August 2025;
• the Protection of Privacy Regulations (Data Security), 5777-2017 (the "Data Security Regulations");
• the Protection of Privacy Regulations (Transfer of Information to Databases Outside the State's Borders), 5761-2001 (the "Transfer Regulations");
• the Communications Law (Telecommunications and Broadcasting), 5742-1982, in relation to marketing messages; and
• any other applicable Israeli law, including the Prohibition on Money Laundering Law, 5760-2000 and orders made under it, where applicable.

We are the controller (בעל מאגר) of the databases in which your Personal Information is held. Where a service provider holds Personal Information on our behalf, that provider is a holder (מחזיק) and acts only on our instructions.

4. What Personal Information we collect

We may collect and use the following:

• name and contact details;
• Israeli ID number or passport number, and date of birth;
• employer, job title and responsibilities;
• information relating to your use of our website;
• identity documents, proof of address and other KYC information;
• financial information, including bank details, source of wealth and source of funds, asset and income information, and investment experience, objectives and risk tolerance;
• information required for anti-money-laundering, sanctions and PEP screening; and
• any further information you provide during onboarding, due diligence or regulatory checks.

Some of the above — in particular information about your financial position, assets and income — is classified as sensitive information (מידע רגיש) under the PPL, and we apply enhanced safeguards to it.

5. How we collect Personal Information

We collect Personal Information directly from you when you complete our forms, engage us for services, correspond with us, or use our website.

We also obtain Personal Information from third parties, including public and regulatory registers, company websites, search engines, sanctions and PEP screening databases, and third-party KYC/AML providers.

6. Notice at the point of collection (section 11 of the PPL)

Where we ask you to provide Personal Information, we will tell you at the time:

• whether you are under a legal obligation to provide it, or whether it is provided voluntarily and on the basis of your consent;
• the purpose for which the information is requested;
• to whom the information will be transferred and for what purposes; and
• the consequences of not providing it.

In most cases, we cannot onboard you as a client or continue to provide services without the information we request, because we are required to collect and verify it in order to meet anti-money-laundering standards and the requirements of the banks and counterparties through which we operate.

7. Personal Information about other people

If you provide us with Personal Information about another person — for example a beneficial owner, authorised signatory, family member or professional adviser — you confirm that you are entitled to do so and that you have informed them how we will use their information, or that you will direct them to this Privacy Policy.

8. What we use Personal Information for

We use Personal Information to:

• understand your requirements and assess suitability;
• provide, administer and manage our services;
• carry out client onboarding, identification, verification and ongoing due diligence;
• comply with our legal and regulatory duties, including anti-money-laundering, sanctions, reporting and record-keeping obligations;
• respond to your enquiries and communicate with you about our services and about changes to them;
• manage our own business, including accounting, audit, IT and risk management; and
• establish, exercise or defend legal claims and protect our legal rights.

9. Basis for processing

Under Israeli law, we process Personal Information on the basis of:

• your informed consent, given when you provide information to us following the notice described in section 6; and
• legal and regulatory obligations that require us to collect, retain, verify or report information, in which case processing does not depend on your consent.

Where processing relies on your consent, you may withdraw it. Withdrawal does not affect processing already carried out, and does not affect information we are separately required by law to hold. Withdrawing consent may mean we can no longer provide our services to you.

10. Marketing and direct mailing

We will only send you marketing communications where we are permitted to do so under section 30A of the Communications Law (Telecommunications and Broadcasting), 5742-1982 and Chapter B of the PPL.

Every marketing message will identify us as the sender and will give you a simple way to tell us to stop. You may ask us at any time, at no cost, to stop sending you marketing messages and to remove your details from any direct-mailing list we maintain. We will act on that request without delay.

11. Sharing Personal Information

We may share Personal Information with:

• service providers acting on our behalf, including IT and hosting providers, KYC/AML screening providers, accountants, auditors and legal advisers;
• ATYD Capital Ltd, our holding company, for administration, oversight and shared support functions;
• banks and other financial institutions where necessary to provide our services;
• regulators, tax authorities, law-enforcement bodies and courts, where we are required or permitted to disclose; and
• any party to whom we are required to disclose by law or court order.

Where a service provider holds Personal Information on our behalf, we put a written agreement in place governing the permitted uses, security requirements and return or deletion of the information, as required by the Data Security Regulations.

12. Transfers of Personal Information outside Israel

We transfer Personal Information outside Israel, in particular to the United Kingdom, where our holding company is located, and to countries in which our service providers operate.

We transfer Personal Information abroad only where permitted under the Transfer Regulations. In practice we rely on transfers to countries that receive data from EEA member states under equivalent terms, or on a written undertaking from the recipient to comply with the conditions for holding and using data that apply under Israeli law. We take reasonable steps to ensure that recipients apply protection at least equivalent to that required in Israel.

13. How long we keep Personal Information

We keep Personal Information for as long as we need it for the purposes set out above, and for as long as we are required to keep it by law.

In particular, records relating to client identification, due diligence and transactions are retained for at least seven years after the end of our relationship with you or after the relevant transaction, in line with the anti-money-laundering standards we apply and with Israeli record-keeping and tax requirements.

When Personal Information is no longer required, we delete it or irreversibly anonymise it.

14. Security

We apply technical, organisational and physical measures to protect Personal Information, in accordance with the Data Security Regulations. These include classification of our databases and application of the security level required for each, access control and user permissions, logging and monitoring of access, encryption of data in transit and at rest where appropriate, staff training, periodic security review, and written agreements with our service providers.

We maintain a database definition document as required by the Data Security Regulations.

If a data-security incident occurs, we will handle it in accordance with the Data Security Regulations, including notifying the Privacy Protection Authority, and notifying affected individuals where required.

Please note that no transmission of information over the internet can be guaranteed to be completely secure.

15. Cookies

We do not currently use cookies. If this changes, we will update this Privacy Policy and, where required, seek your consent before non-essential cookies are set.

16. Links to other websites

Our website at www.ggc.co.il may contain links to third-party websites. We are not responsible for the privacy practices of those websites, and we encourage you to read their own privacy policies.

17. Your rights

Under the PPL you may:

• request access to the Personal Information we hold about you (section 13 of the PPL);
• request correction, completion or deletion of information that is incorrect, incomplete, unclear or out of date (section 14 of the PPL);
• ask to be removed from any direct-mailing list we maintain, and to be told the source of your details on that list; and
• withdraw your consent to processing that relies on consent, subject to section 9 above.

To exercise any of these rights, contact us using the details in section 19. We will respond within the time period required by law. We may need to verify your identity before acting on a request. Certain information may be withheld where the law permits or requires us to do so — for example, where disclosure would prejudice an anti-money-laundering investigation or report.

18. Complaints

If you are not satisfied with how we have handled your Personal Information, please contact us first so we can try to resolve it.

You may also complain to the Israeli Privacy Protection Authority (הרשות להגנת הפרטיות):

Privacy Protection Authority, Ministry of Justice

2 Wolfson Boulevard, David Ben-Gurion Government Quarter, Jerusalem 9711052

Postal address: P.O.B. 49029, Jerusalem 9149001

Website: www.gov.il/en/departments/the_privacy_protection_authority

19. Contact details

Gold Grain Capital Investments Ltd

Haanafa 10

Tel Mond, Israel

Website: www.ggc.co.il

Email: info@ggc.co.il

Our Data Protection Officer is David Brandeis, who can be reached at the email address above.