Privacy Statement

Information about our organisation and website(s)

Our Privacy Statement covers Commodity Pricing and Analysis Limited (“CPAL”) and its website(s). It also covers any email communications that we may send to you or your company. CPAL is based in the Dubai International Financial Centre.

We are committed to protecting your privacy. This Privacy Statement describes the
ways in which we collect information from you and what we use it for. Please read the policy to check how your information will be treated. It also describes your data protection rights, including a right to object to some of the processing which CPAL carries out. More information about your rights, and how to exercise them, is set out in the Your Rights section.

This Privacy Statement may be updated periodically. We will update the date at the top of this Privacy Statement accordingly. On some occasions, we may also actively advise you of specific data handling activities or significant changes to this Privacy Statement, as required by applicable law.

The terms of this statement should be read together with our Website Terms and
Conditions, any additional terms and conditions, disclaimers or other contractual terms you have entered into with us and any applicable mandatory laws and regulations, as amended from time to time.

Data Controller

CPAL is the “Data Controller” for the purposes of the Dubai International Financial Centre Data Protection Law (DIFC Data Protection Law). This means we are responsible for deciding how we hold and use your personal data. Where we use third- party service providers to process your data, they act on our instructions as “Data Processors” and are subject to contractual obligations to protect your data.

Personal data we collect

Information collected directly:

• If you are enquiring about, registering for, or using our services, courses, websites or databases, then we will process your personal data - including your name, address, email address and phone number, preferences (e.g. metals you are interested in) and service usernames and passwords.
• If you attend one of our events or express interest in doing so you may provide us with your name, contact information, interests and marketing preferences.
• You may give us information about you when you complete a form on our site or by corresponding with us by phone, e-mail or other electronic means, or in writing.
• We may use CCTV cameras in our premises, which may capture images including your personal data.
• When we send or receive email from you we collect the address and content of the emails, the success or failure of our attempts to send you email, and information about when you receive, open or click on content in emails we send you and any subsequent visits you or other recipients make to our websites.

Information we collect about you from third parties:

With regard to each of your visits to our site we may automatically collect the following information:

• Technical information, including the internet protocol (IP) address used to connect your computer to the internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform.
• Information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our site (including date and time); services or issues you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page.

How we collect personal data

We may collect your personal data in a variety of ways, including:

• Directly from you: when you provide it to us, for example, when registering for our websites, using our services, applying for membership, subscribing to updates, or communicating with us via email, phone, or other channels.
• From your interactions with our services and websites: for example, through cookies, log files, and similar technologies that track usage patterns, preferences, and device information.
• From third parties: such as business partners, service providers or vendors, where necessary for us to provide and improve our services or comply with legal obligations.
• Through automated means: including monitoring of system activity and trading activity to ensure the security, integrity, and orderly functioning of our markets and systems.

We only collect personal data that is necessary for the purposes described in this
privacy statement and in accordance with the applicable laws.

Entrance checks

You may be required to undergo certain limited screening before entering the CPAL’s premises. This could include temperature scanning, health questions or other limited screening to minimise the transmission of certain diseases. We will only ever process this data in accordance with applicable data privacy laws and will not share this data outside of the organisation.

Purpose and legal basis

We use personal data for the following purposes:

(1) Where this is necessary for purposes which are in our, or third parties, legitimate interests. These interests are:

• To carry out sales and business development activities.
• To provide users with access to our websites and features on the websites.
• To market to certain individuals in a business to business context (including, in certain circumstances, marketing undertaken by our group companies including, but not limited to, The London Metal Exchange, LME Clear Limited and Hong Kong Exchanges and Clearing Limited.
• To promote our services and initiatives, including through industry engagement activities and stakeholder communications.
• To send individuals information they have requested.
• To ensure the security of our websites and our systems, by trying to prevent
  unauthorised or malicious activities.
• To enforce compliance with the Website Terms and Conditions and other relevant contracts / policies.
• To ensure the safety and security of our staff and premises through the use of CCTV cameras.
• To undertake internal analysis on, and improvements of, our business.

(2) For purposes which are required by law:

• To carry out anti-money laundering and other due diligence checks required for compliance with the law and our regulatory responsibilities.
• In response to requests by government or law enforcement authorities conducting an investigation.

(3) To fulfil a contract, or take steps linked to a contract:

• To process an individual's registration on our websites.
• To send individuals information about their use of our websites and changes to our terms or policies.

(4) Where you give us consent:

• Where you ask us and our group companies to send marketing information to you via a medium where we may need your consent (for example, email marketing to private email addresses).
• Where you give us consent to place certain cookies and to use similar technologies. Please refer to our cookie clause below.
• On other occasions where we ask you for consent, for the purpose which we explain at that time.

We have carried out balancing tests for all the data processing we carry out on the
basis of our legitimate interests, which we have described above. You can obtain
information on our balancing tests by contacting us using the details set out later in this notice.

Cookies

We use cookies and similar technologies on our websites to collect information about your browsing activities, preferences, and device. Cookies help us to:

• Ensure the proper functioning of our websites;
• Remember your preferences and settings;
• Analyze website traffic and usage patterns;
• Personalize content and advertisements; and
• Improve our services and user experience.

By using our websites, you consent to our use of cookies as described in this policy. You can manage your cookie preferences through your browser settings, but please note that disabling certain cookies may affect the functionality of our websites.

Confidentiality/Security

We have implemented security policies, rules and technical measures to seek to protect the personal data that we have under our control from:

• unauthorised access
• improper use or disclosure
• unauthorised modification
• unlawful destruction or accidental loss

All our employees and data processors who have access to and are associated with the processing of personal data are obliged to respect the confidentiality of your personal data.

Data sharing

The personal data we process will be shared as follows:

• With companies providing services to us which require the processing of personal data, such as training providers, insurance brokers, payment processors, identity verification and security providers, and IT hosting, IT platform and/or IT maintenance providers, marketing agencies, email management suppliers, and service providers which assist with our commercial and legal due diligence processes.
• With the HKEX group (including The London Metal Exchange and LME Clear Limited) who may store personal data on our behalf on shared servers and engage in certain marketing activities on behalf of CPAL.
• With government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the protection of our legitimate interests in compliance with applicable laws.
• To any regulators as requested or required under applicable laws.
• In the event that our business is sold or integrated with another business, your
  personal data may be disclosed to our advisers and any prospective purchaser's adviser and will be passed to the new owners of the business.

Except where you have explicitly given us permission, we will not pass your details onto any other organisations (except as noted above) or publish them publicly. Where you have requested us to pass on details to related organisations we will require them to comply with this privacy policy.

International transfers

Where we transfer your personal data outside the DIFC, we will ensure that appropriate safeguards are in place, such as adequacy decisions, standard contractual clauses, or other mechanisms approved by the DIFC Commissioner of Data Protection, to ensure your data is protected to the required standard.

Your rights

You have the right to ask us for a copy of your personal data; to correct, delete or
restrict processing of your personal data; and to obtain the personal data you provide in a structured, machine readable format.

In addition, you can object to the processing of your personal data in some
circumstances (in particular, where we don’t have to process the data to meet a
contractual or other legal requirement). Where we have asked for your consent, you may withdraw consent at any time. If you ask to withdraw your consent to us processing your data, this will not affect any processing which has already taken place at that time.

You can object at any time to our use of your personal data for direct marketing
purposes, by contacting us using the information below.

You also have the right not to be subject to a decision based solely on automated
processing, including profiling, which produces legal or similarly significant effects.

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep. In line with the DIFC Data Protection Law, these rights are subject to certain conditions and exceptions. We may also need to request specific information from you to confirm your identity before we can respond to your request.

If you have unresolved concerns, you have the right to complain to a data protection authority in the country in which you live or work.

Retention

Where we process personal data for marketing and client relationship management purposes or with your consent, and you remain an active user of our websites or services, we process the data until you ask us to stop and for a short period after this (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing or to process your data indefinitely so that we can respect your request in future. Where you cease to be an active user of our websites or services, we will retain your data used for marketing and client relationship management purposes for a period of two years from your last interaction with us.

Recordings of telephone calls

We may record:

(a) telephone calls made or received by representatives of CPAL

(b) the telephone number from which callers telephone CPAL, together with the time, date and content of the call for the purpose of complying with our legal and regulatory obligations.

We may maintain records relating to (a) and (b) above, in each case in accordance with the CPAL’s policies from time to time and applicable law.

Privacy support

If you have any questions or concerns about our privacy policy or how we handle your personal data, please contact:

DIFC (UAE)

(DIFC entity) at team@lmeinsight.com