Privacy Policy

Strata Solas Wealth Management LLC ("Company," "we," "us," or "our"), a Delaware limited liability company (EIN: 30-1477567), is the data controller responsible for your personal data collected through this website. This Privacy Policy explains how we collect, use, disclose, and protect information when you visit strata-solas.com (the "Site") or interact with us in connection with our investment offerings.

Please read this policy carefully before using the Site or submitting personal information.

Data Minimization: We collect only the personal data that is necessary and proportionate to the purposes described in this Policy.

EU Representative: As the Company targets investors in the European Economic Area (EEA), we are in the process of designating an EU representative as required under Article 27 of the GDPR. Until such designation is complete, EEA data subjects may direct privacy inquiries to support@swcfield.com. We will provide updated EU representative contact details on this page once the appointment is finalized.

For all privacy inquiries: support@swcfield.com

If you are located in the EEA or United Kingdom, you have specific rights under GDPR and UK GDPR described in Section 8. If you are a California resident, see Section 9.

2.1 Information You Provide Directly:

• Full name, email address, phone number submitted via contact forms or investor inquiries;
• Identity documents (passport, national ID, proof of address) for KYC/AML verification;
• Financial information, source of funds documentation, and accredited investor verification materials;
• Tax forms including IRS Form W-8BEN (individuals) or W-8BEN-E (entities);
• Subscription documents and related investor documentation;
• Digital asset wallet addresses and blockchain transaction data for USDT subscriptions;
• Communications you send to us by email or through the Site.

2.2 Information Collected Automatically:

• IP address, browser type, operating system, and device information;
• Pages visited, time spent on pages, and referring URLs;
• Cookies and similar tracking technologies (see Cookie Policy at strata-solas.com/cookies).

2.3 Information from Third Parties:

• KYC/AML verification results from our authorized providers (including Sumsub or equivalent);
• Blockchain analytics and on-chain transaction data for digital asset compliance screening;
• Sanctions, PEP (Politically Exposed Persons), and adverse media screening results.

We process your personal information for the following purposes. For EEA/UK residents, the applicable GDPR legal basis is indicated:

Automated Processing: We may use automated processes for identity verification (KYC), fraud detection, and compliance screening including blockchain analytics. These processes may affect your eligibility to invest. You have the right to request human review of any automated decision that significantly affects you by contacting support@swcfield.com.

Marketing: You may opt out of marketing communications at any time by contacting us or clicking the unsubscribe link in any email.

We do not sell your personal information. We may share your information with:

• Keystra Ltd. (SWC Field platform, Seychelles) — our technology partner handling investor onboarding and KYC/AML, subject to data processing agreements;
• KYC/AML providers (e.g., Sumsub or equivalent) — for identity and sanctions screening;
• Blockchain analytics providers — for digital asset transaction compliance;
• U.S. Internal Revenue Service (IRS) — as required by FATCA and U.S. tax law;
• Legal, compliance, and accounting advisors — subject to professional confidentiality;
• Law enforcement or regulatory authorities — when required by applicable law or court order;
• Successors in interest — in the event of a merger or acquisition, subject to the same privacy commitments.

All third-party service providers are contractually required to protect your information and use it solely for authorized purposes.

The Company is based in the United States. Personal information may be transferred to and processed in the United States, UAE, United Kingdom, and other jurisdictions where our service providers operate.

For transfers of personal data from the EEA or United Kingdom to the United States or other third countries, we rely on the European Commission's Standard Contractual Clauses (SCCs, 2021 version) as the primary legal transfer mechanism. SCCs are the legal basis for these transfers — not consent. We supplement SCCs with additional technical and organizational safeguards including encryption, access controls, and contractual protections, and we conduct transfer impact assessments where required by applicable guidance.

Data processed in connection with UAE-based investors or service providers may be subject to UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL). We implement appropriate safeguards for all cross-border data transfers.

Certain vendors (including Google Analytics) may be certified under the EU-U.S. Data Privacy Framework (DPF). We rely on SCCs and DPF certification as applicable for data flows to the United States.

We retain personal information as follows:

• Investor and subscription records: for the longer of (i) the duration of your investment relationship plus 7 years, or (ii) as required by applicable U.S. securities law, AML regulations, or ongoing legal proceedings;
• KYC/AML records: as required by applicable law, generally 5–7 years from the end of the business relationship;
• IRS/FATCA tax records: as required by IRS regulations, generally 7 years;
• Site analytics and usage data: up to 24 months;
• Marketing consent records: until consent is withdrawn plus 1 year.

After the applicable retention period, data is securely deleted or anonymized. Retention may be extended where required by regulators, auditors, or ongoing legal proceedings.

Blockchain Data: Please note that on-chain transaction data (including wallet addresses and transaction hashes) recorded on public blockchains is publicly accessible and technically cannot be deleted, modified, or erased. We have no control over blockchain data once a transaction is confirmed.

We implement reasonable technical and organizational measures to protect your information, including encryption, access controls, and security monitoring. No method of transmission over the Internet is 100% secure.

Data Breach Notification: In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify affected individuals without undue delay. Where required by GDPR or UK GDPR, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach.

Depending on your jurisdiction, you may have the following rights:

• Access: request a copy of the personal information we hold about you;
• Correction: request correction of inaccurate or incomplete information;
• Erasure: request deletion of your personal information, subject to legal retention obligations;
• Restriction: request restriction of processing in certain circumstances;
• Portability: receive your data in a structured, machine-readable format;
• Objection: object to processing based on legitimate interests;
• Automated decisions: request human review of automated decisions that significantly affect you;
• Withdrawal of consent: withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any right, contact us at support@swcfield.com. We will respond within 30 days. You have the right to lodge a complaint with the supervisory authority in your jurisdiction:

• EEA: your national Data Protection Authority (DPA);
• UK: the Information Commissioner's Office (ICO) at ico.org.uk;
• Other jurisdictions: applicable local data protection authority.

If you are a California resident, the following rights apply under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: request disclosure of categories and specific pieces of personal information collected, sources, purposes, and third parties with whom we share it;
• Right to Delete: request deletion of personal information, subject to certain exceptions;
• Right to Correct: request correction of inaccurate personal information;
• Right to Opt-Out: we do NOT sell or share your personal information for cross-context behavioral advertising;
• Right to Limit Sensitive PI: request limitation of use of sensitive personal information to necessary purposes;
• Right to Non-Discrimination: we will not discriminate for exercising CCPA rights.

Categories of personal information collected (past 12 months): identifiers (name, email address, IP address, device identifiers); financial information (investment amounts, source of funds); internet or network activity (browsing data, page visits); professional or employment information; government-issued identification numbers (for KYC purposes — sensitive personal information); biometric information (where applicable for identity verification).

To exercise California rights, contact support@swcfield.com. We will respond within 45 days. You may designate an authorized agent to submit requests on your behalf.

The Site is not directed to persons under 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a person under 18, please contact us immediately.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy with a new "Last Updated" date. For significant changes affecting EEA/UK residents, we will provide more prominent notice where required by GDPR.

Strata Solas Wealth Management LLC — Data Privacy
1007 N Orange St, 4th Floor, Suite 1382, Wilmington, DE 19801, USA
Email: support@swcfield.com · Phone: SWCField.com

EU Representative: To be designated (see Section 1). Updates will be posted on this page.