Privacy Notice

1. About This Privacy Notice

This Privacy Notice explains how Canary Bulls ("Canary Bulls", "we", "us" or "our") collects, uses, stores and protects personal information when you use the Canary Bulls website, software, platform, applications and related services (collectively, the "Service").

It also explains your rights under applicable data protection law, including the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

This Privacy Notice should be read together with the Canary Bulls Terms of Use and Software Licence and, where applicable, our Cookie Policy.

2. Who We Are

The organisation responsible for deciding how and why your personal information is processed is:

If you have questions about this Privacy Notice or how your personal information is handled, you can contact us using the details above.

3. Personal Information We Collect

The information we collect depends on how you use the Service. This may include:

Account information

• name or display name;
• email address;
• username;
• password credentials, stored in an appropriately protected form;
• account preferences;
• profile information; and
• other information you choose to provide.

Service and usage information

• pages, features and functionality you access;
• dates and times of access;
• interactions with the Service;
• device and browser information;
• IP address;
• security and authentication logs; and
• technical information necessary to operate and secure the Service.

User-generated information

If the Service allows you to create profiles, publish content, communicate with other users or otherwise contribute information, we may process the information you choose to provide through those features.

Communications

If you contact us, submit a report, make a complaint or otherwise communicate with Canary Bulls, we may retain the information contained in that communication and information reasonably necessary to respond to it.

4. Where We Obtain Information

We may obtain personal information:

• directly from you;
• automatically when you use the Service;
• from devices and browsers used to access the Service;
• from service providers supporting the Service; and
• from other lawful sources where necessary and appropriate.

5. How We Use Personal Information

Depending on the circumstances, we may use personal information to:

• create and manage your account;
• provide and operate the Service;
• authenticate users and maintain account security;
• personalise or configure aspects of the Service;
• communicate with you about your account or the Service;
• respond to support requests and complaints;
• moderate content and investigate abuse;
• detect, prevent and investigate fraud, misuse and security incidents;
• maintain, troubleshoot and improve the Service;
• understand how the Service is used;
• comply with legal and regulatory obligations;
• establish, exercise or defend legal claims; and
• protect the rights, property and safety of Canary Bulls, users and others.

6. Lawful Bases for Processing

Where the UK GDPR applies, we rely on one or more lawful bases for processing your personal information.

The applicable lawful basis depends on the particular processing activity. We do not rely on consent where another lawful basis is more appropriate.

7. Legitimate Interests

Where we rely on legitimate interests, these may include operating and improving the Service, maintaining security, preventing fraud and abuse, protecting our systems and users, administering our business, responding to enquiries, and establishing or defending legal claims.

Where required, we balance our legitimate interests against your interests, rights and freedoms before relying on this lawful basis.

8. Special Category Data

We do not generally seek to collect special category personal data through the Service.

You should not provide sensitive personal information through the Service unless it is specifically requested for a lawful purpose.

If special category data is processed, we will do so only where an appropriate legal condition under applicable data protection law applies.

9. User Content and Public Information

Some features of Canary Bulls may allow information you submit to be visible to other users or the public.

You should carefully consider what personal information you choose to publish through public profiles, posts, communications or other user-generated content.

Do not publish another person's personal information without an appropriate lawful basis or their permission where required.

10. Who We Share Personal Information With

We may share personal information where necessary for the purposes described in this Privacy Notice.

Depending on the Service, recipients may include:

• hosting and infrastructure providers;
• database and storage providers;
• email and communications providers;
• security and fraud-prevention providers;
• analytics providers;
• customer support providers;
• payment providers, where applicable;
• professional advisers;
• law enforcement or regulatory authorities where legally required; and
• other service providers acting on our behalf.

Where a third party processes personal information on our behalf, we will take appropriate steps to ensure that the processing is subject to appropriate contractual and legal safeguards.

11. Business Transfers

If Canary Bulls is involved in a merger, acquisition, restructuring, financing, sale of assets or similar transaction, personal information may be transferred as part of that transaction where lawful and subject to appropriate safeguards.

12. International Data Transfers

Some of our service providers or recipients may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will take appropriate steps to ensure that the transfer is lawful and that appropriate safeguards are in place as required by applicable data protection law.

Depending on the circumstances, safeguards may include an adequacy decision, appropriate contractual safeguards or another lawful transfer mechanism.

13. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to provide the Service, maintain security, comply with legal obligations and resolve disputes.

Retention periods vary depending on the type of information and the reason it is processed.

When personal information is no longer required, we will delete it, anonymise it or otherwise securely dispose of it, subject to applicable legal or regulatory requirements.

14. Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, accidental loss, destruction, alteration, disclosure or other unlawful processing.

Security measures may include access controls, authentication, encryption where appropriate, monitoring, logging, secure development practices and other safeguards appropriate to the nature of the information and risks involved.

No internet transmission or storage system can be guaranteed to be completely secure.

15. Automated Decision-Making and Profiling

We may use automated processes for operational purposes such as security, fraud detection, abuse prevention, analytics or personalisation.

Where applicable data protection law gives you rights in relation to solely automated decision-making that produces legal or similarly significant effects, we will provide the information and safeguards required by law.

16. Marketing Communications

We may send service-related communications that are necessary to operate your account or provide the Service.

Where we send direct marketing communications, we will do so in accordance with applicable data protection and electronic communications laws and will provide appropriate ways to manage your preferences or opt out where required.

17. Cookies and Similar Technologies

Canary Bulls may use cookies, local storage, pixels and similar technologies to operate, secure, analyse and improve the Service.

Further information about the technologies we use and how applicable consent choices are managed is provided in our Cookie Policy.

18. Your Data Protection Rights

Subject to applicable law and any relevant exemptions, you may have the following rights:

• Right of access — to request a copy of personal information we hold about you.
• Right to rectification — to request correction of inaccurate or incomplete information.
• Right to erasure — to request deletion of personal information in certain circumstances.
• Right to restriction — to request restriction of processing in certain circumstances.
• Right to data portability — to receive certain information in a structured, commonly used and machine-readable format.
• Right to object — to object to certain processing, including processing based on legitimate interests and certain direct marketing.
• Rights relating to automated decision-making — where applicable under data protection law.
• Right to withdraw consent — where processing relies on consent.

These rights are not absolute and may be subject to legal conditions and exemptions.

19. Exercising Your Rights

To exercise a data protection right, contact us using the privacy contact details provided in this Privacy Notice.

We may need to request additional information to verify your identity before fulfilling certain requests. This is intended to protect your personal information from unauthorised disclosure.

We will normally respond to valid requests within the period required by applicable data protection law.

20. Complaints to the ICO

We would appreciate the opportunity to resolve privacy concerns directly, so please contact us first where possible.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office ("ICO"), if you believe that your personal information has been processed unlawfully or your data protection rights have been infringed.

The ICO can be contacted through its official website or telephone service.

21. Children and Young People

The Service is not intended for users who are below the minimum age stated in our Terms of Use.

We do not knowingly collect personal information from children in circumstances where doing so is prohibited by applicable law.

If you believe that a child has provided personal information to Canary Bulls in circumstances where they should not have done so, please contact us so that we can investigate and take appropriate action.

22. Third-Party Websites and Services

The Service may contain links to third-party websites, applications or services.

Those third parties operate independently of Canary Bulls and may have their own privacy policies and practices. We are not responsible for the privacy practices of third-party services that we do not control.

23. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes to the Service, our processing activities, technology, legal requirements or regulatory guidance.

Where appropriate, we will notify users of material changes through the Service or other reasonable means.

The effective date shown at the top of this Privacy Notice indicates when the current version took effect.

24. Contact Us

25. Privacy Notice Version

Privacy Notice version: 1.0

Effective date: 02 October 2026