Privacy Policy

Titan Eagle Limited is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights in relation to it. This policy applies to all personal data collected through the Titan Eagle Limited platform, including data provided at account registration, during plan management, and in the course of ongoing use of the service. Please read this policy carefully. If you have questions, contact us at contact@titaneagle.gold.

We collect the following categories of personal data: • Name — provided at account registration and used to identify your account and personalise communications. • Email address — used for account authentication, plan management, and service notifications. • Postal address — collected where required to fulfil physical gifts or rewards associated with your plan tier. • Payment information — card details and billing information are handled directly by Stripe, our payment processor. Titan Eagle Limited does not store card numbers or full payment credentials on its own servers. We do not collect sensitive personal data (such as health data, biometric data, or data revealing racial or ethnic origin) and we have no legitimate basis to do so.

We use your personal data only for the purposes described in this policy: • Provide services — to operate and maintain your Titan Eagle Limited account, allocate gold to your holdings, and display your portfolio within the dashboard. • Manage plans — to process recurring payments via Stripe, send payment confirmations, and administer plan changes, pauses, and cancellations. • Comply with legal obligations — to satisfy applicable regulatory, tax, and anti-money-laundering requirements, and to respond to lawful requests from regulatory or law enforcement authorities. We will not use your personal data for any purpose incompatible with those described above without first obtaining your consent.

We process your personal data on the following legal bases under UK GDPR Article 6: • Contract — processing is necessary to perform our contract with you (i.e., to deliver the plan service, allocate gold, and operate your account). • Legal obligation — processing is necessary to comply with applicable laws, including financial crime regulations and data protection law itself. • Legitimate interests — we may process data where it is in our legitimate interests to do so and those interests are not overridden by your rights (for example, to maintain platform security, prevent fraud, and improve the service). Where we rely on legitimate interests, we conduct a balancing test to ensure the processing is proportionate and respects your reasonable expectations.

We share your personal data only with third parties that are necessary for the operation of the service: • Stripe — our payment processor. Stripe receives payment information to process recurring payment charges. Stripe processes data as an independent controller and is subject to its own privacy policy and PCI-DSS obligations. • Custody providers — our vault partner receives the minimum information required to maintain allocated gold records under your name. • Legal and regulatory authorities — we will disclose personal data to courts, regulators, or law enforcement where we are required or permitted to do so by law. • The person who referred you — if you joined through a referral link, invitation or code, a limited amount of information about your account is shared with the person who referred you. Section 6 sets out exactly what. Apart from the sharing described above and in section 6, we do not sell, rent, or otherwise disclose your personal data to third parties for marketing or commercial purposes.

If you joined Titan Eagle Limited through a referral link, invitation or code, we share a limited amount of information about your account with the person who referred you. They may be a member of the Creator Academy or a member taking part in the Member Referral Programme. We share it so they can recognise the people they introduced and check what they have been credited. It is shared only with that one person, and only if you joined through their link, invitation or code. No other member or creator sees it. We share only the following: • Your first name and the initial of your surname — for example Jimena F. Your surname is never shown in full. • A masked form of your email address — for example j****a@****.com. The masking is applied on our servers before the information leaves them, and the domain name is withheld, leaving only the ending such as .com. The person who referred you never receives your address in a form that can be reversed. This is shared with Creator Academy members only. • The date you joined through their link. • Whether you have made the four monthly payments that make you a funded member, and the date you did. • Whether your subscription is currently active. This is shared with Creator Academy members only. • The name of the plan you are on. This is shared with Creator Academy members only. We do not share your full email address, your surname in full, your postal address, your payment details, the amount you pay, your gold holdings or your transaction history. This information is not anonymous. Somebody who already knows you may well recognise you from it, which is the purpose it serves. We share it because it is necessary to operate the referral arrangement we have with that person, and because we have a legitimate interest in a referral programme whose participants can verify what they have been credited. Both bases are described in section 4. The people who take part in these programmes are bound by the Creator Academy Terms and Conditions or the Member Referral Terms and Conditions, which require them to keep this information confidential and not to use it to contact you.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure: • Secure storage — account data is held in a managed cloud database with strict access controls. Production data is not accessible from development environments. • Access controls — access to personal data is restricted to authorised personnel on a need-to-know basis. Administrative access requires multi-factor authentication. • Encryption where appropriate — data in transit is protected using TLS. Sensitive fields are encrypted at rest where technically practicable. No method of transmission or storage is completely secure. If you become aware of any security concern relating to your account, please notify us immediately at contact@titaneagle.gold.

Under UK GDPR, you have the following rights in relation to your personal data: • Request access — you may request a copy of the personal data we hold about you (a "subject access request"). • Request correction — you may ask us to correct any inaccurate or incomplete personal data. • Request deletion — you may ask us to erase your personal data where we no longer have a lawful basis to retain it. You also have the right to object to certain processing, to request restriction of processing in limited circumstances, and to data portability where processing is based on consent or contract and carried out by automated means. To exercise any of these rights, please contact us at contact@titaneagle.gold. We will respond within one month of receiving your request. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Data is retained only as long as necessary for the purposes for which it was collected, or as required by applicable law. Account data is retained for the duration of your plan and for a period of up to seven years thereafter, to comply with our financial record-keeping obligations. Payment transaction records are retained for the period required under applicable tax and anti-money-laundering legislation. Where you request deletion of your account, we will erase or anonymise personal data that we are not legally required to retain within 30 days of the request.