Privacy Policy

1. Introduction

This Privacy Policy (the "Policy") describes how Osher LTD (hereinafter, the "Company", "we", "us" or "our") collects, uses, stores, discloses and protects the personal data of users who visit the website https://osherltd.com (the "Website") and of clients who use the Company's online trading services, including foreign exchange (Forex) and contracts for difference (CFDs) on various underlying instruments (the "Services").

Osher LTD is an International Business Company with registration number 2026-00461, incorporated in accordance with the International Business Companies Act Cap 12.14 of the Revised Laws of Saint Lucia, 2001. The registered office for corporate records is established with the agent Foster Capital Inc, located at Robin Kelton Bldg, Choc Bay, P.O. Box GM763, Castries, Saint Lucia.

By accessing the Website, opening an account or otherwise using the Services, you acknowledge that you have read and understood the practices described in this Policy.

This Policy is governed by the laws of Saint Lucia, including the Data Protection Act of Saint Lucia (Act No. 11 of 2011) and other applicable legislation. Where the Company processes personal data of individuals located in jurisdictions whose data protection laws extend extraterritorially, the Company will comply with applicable additional requirements to the extent legally required.

2. Data Controller

The data controller responsible for the processing of your personal data is:

3. Eligibility and Restricted Jurisdictions

The Services are intended for an international audience aged 18 years or older. The Services are not offered, and are not intended to be offered, to residents, citizens or persons located in any jurisdiction where the offer of such Services would be contrary to local law or regulation, including, without limitation, the following countries:

Afghanistan, Belarus, Burkina Faso, Burundi, Canada, Central African Republic, Congo, Cuba, Eritrea, Guinea, Guinea-Bissau, Guyana, Haiti, India, Iran, Mali, Myanmar, North Korea, Russia, Saint Lucia, Sierra Leone, Singapore, Somalia, South Sudan, Sudan, Ukraine, United States of America, Vanuatu, Venezuela, Yemen.

The Company does not provide access to any country listed on any United Nations sanctions list. The Services are not available to residents of the United States or Canada.

If you access the Website from a restricted jurisdiction, you do so on your own initiative and are responsible for compliance with the laws applicable to you. The Company reserves the right to refuse, suspend or terminate the account of any user found to be ineligible.

4. Data Protection Contact

For any matter relating to the processing of your personal data, including the exercise of your rights set out in this Policy, you may contact the Company at:

• Email: [email protected]
• Postal address: Foster Capital Inc, Robin Kelton Bldg, Choc Bay, P.O. Box GM763, Castries, Saint Lucia

5. Categories of Personal Data Collected

In the course of providing the Services and operating the Website, the Company processes the following categories of personal data:

a) Identification data: full name, date and place of birth, nationality, residential address, tax identification number or equivalent.

b) Contact data: email address, telephone number, postal address.

c) Identity verification documents ("KYC"): copy of valid government-issued identity document (passport, national ID card, driver's licence), proof of residence (utility bill, bank statement), selfie or video for biometric verification, and any additional documentation requested as part of enhanced due diligence.

d) Economic and financial data: profession, income range, source of funds, source of wealth, net worth, bank account details (IBAN, SWIFT/BIC), payment card data, deposit and withdrawal history.

e) Suitability and appropriateness data: trading experience, knowledge of financial markets, investment objectives, risk tolerance, as collected through onboarding questionnaires.

f) Trading and account data: orders placed, open and closed positions, leverage used, realised and unrealised profit and loss, transaction logs, login records.

g) Technical and navigation data: IP address, device identifiers, browser type and version, operating system, pages visited, date and time of access, referrer URL, data collected through cookies and similar technologies (see Cookie Policy).

h) Communications data: records of telephone calls, live chat conversations, emails and other communications exchanged with the Company, retained for the purposes set out in Section 6.

i) Data from public sources and third parties: information obtained from sanctions and watchlists, lists of Politically Exposed Persons (PEPs), anti-money laundering databases, public registers, credit reference and commercial information agencies.

6. Purposes of Processing and Legal Basis

Personal data is processed for the following purposes, each based on a specific legal ground:

6.1 Account opening, client identification (KYC) and anti-money laundering / counter-terrorism financing compliance (AML/CFT) — Legal basis: compliance with legal and regulatory obligations.

6.2 Performance of the client agreement and provision of the Services — Legal basis: performance of a contract.

6.3 Suitability and appropriateness assessment of clients — Legal basis: performance of a contract and legal obligation.

6.4 Recording and retention of communications relating to orders and complaints — Legal basis: legal obligation and legitimate interest.

6.5 Tax, accounting and reporting obligations — Legal basis: compliance with legal obligations.

6.6 Customer support, complaints handling and dispute resolution — Legal basis: performance of a contract and legitimate interest.

6.7 Fraud prevention, transaction monitoring, IT security and protection of Company assets — Legal basis: legitimate interest.

6.8 Direct marketing of the Company's own products and services to existing clients — Legal basis: legitimate interest, subject to right to object.

6.9 Marketing communications, newsletters and promotional offers from the Company and/or selected third parties — Legal basis: consent.

6.10 Profiling for commercial purposes and analysis of user behaviour — Legal basis: consent.

6.11 Operation of the Website and strictly necessary cookies — Legal basis: legitimate interest.

6.12 Analytics, profiling and marketing cookies — Legal basis: consent.

The provision of personal data for the purposes set out in Sections 6.1 to 6.7 is mandatory: failure to provide such data will result in the inability to open or maintain an account or to access the Services. The provision of personal data for marketing and profiling purposes (Sections 6.9, 6.10, 6.12) is optional and refusal does not affect your ability to use the Services.

7. How We Process Your Data

Personal data is processed using electronic, telematic and, where necessary, paper-based means, in accordance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation, integrity and confidentiality.

The Company implements appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk, including, without limitation: encryption of data in transit (TLS) and at rest, segregation of access rights, multi-factor authentication, intrusion detection systems, periodic backups and disaster recovery procedures.

8. Recipients and Categories of Recipients

Personal data may be disclosed, solely for the purposes set out above, to the following categories of recipients:

• Authorised personnel of the Company, who have been duly trained and bound by confidentiality obligations;
• External service providers acting as data processors, including: technology and cloud service providers, software vendors, trading platform and execution technology providers, KYC/AML onboarding and identity verification providers, payment service providers (PSPs), marketing service providers, customer support agencies, accounting, tax and legal advisors, debt collection agencies;
• Banking institutions and payment service providers for the execution of deposits, withdrawals and transfers;
• Liquidity providers, prime brokers, market makers and execution venues, to the strict extent necessary for the execution of client orders;
• Judicial, law enforcement, regulatory and tax authorities in Saint Lucia or any other competent jurisdiction, where required to do so by applicable law, court order, subpoena or lawful request;
• Affiliated companies within the Company's corporate group, where applicable, for internal administrative purposes.

Personal data will not be sold, rented or otherwise made available to third parties for their own marketing purposes without your prior, free, specific and informed consent.

An updated list of data processors is available upon written request to [email protected].

9. International Data Transfers

Given the global nature of the Services, personal data may be transferred to, stored in or processed in countries other than Saint Lucia, including jurisdictions whose data protection laws may differ from those of your country of residence.

Where such transfers occur, the Company takes reasonable steps to ensure that personal data is protected in accordance with this Policy, including by:

• entering into contractual arrangements with recipients imposing confidentiality and security obligations;
• where applicable, relying on appropriate transfer mechanisms recognised under applicable data protection law (such as standard contractual clauses or adequacy decisions, to the extent these apply to the data subject's jurisdiction);
• limiting transfers to recipients providing adequate safeguards.

A copy of the safeguards in place may be requested at [email protected].

10. Retention Period

Personal data is retained only for as long as necessary for the purposes for which it was collected and to comply with applicable legal and regulatory obligations:

• Client agreement data, KYC records, AML/CFT documentation: at least 7 years from the end of the business relationship, in line with international AML standards (FATF Recommendations).
• Records of communications relating to orders and transactions: at least 5 years from the date of the communication.
• Accounting, financial and tax records: 7 years or such longer period as required by applicable law.
• Marketing data processed on the basis of consent: until withdrawal of consent or, failing that, a maximum of 24 months from last meaningful contact.
• Profiling data: until withdrawal of consent or, failing that, a maximum of 12 months.
• Website navigation data and technical logs: up to 12 months, save where retention is required for the investigation of offences.
• Data processed for the establishment, exercise or defence of legal claims: for the duration of the relevant proceedings and the applicable statutory limitation periods.

Upon expiry of the relevant retention period, personal data is securely deleted or irreversibly anonymised.

11. Your Rights

Subject to applicable law and to the limitations set out below, you have the following rights in relation to your personal data:

• Right of access: to obtain confirmation as to whether your personal data is being processed and to receive a copy of it;
• Right to rectification: to request correction of inaccurate or incomplete data;
• Right to erasure: to request deletion of your data, subject to the Company's legal retention obligations;
• Right to restriction: to request the limitation of processing in certain circumstances;
• Right to data portability: to receive your data in a structured, commonly used and machine-readable format;
• Right to object: to object to processing based on legitimate interest, and at any time to object to processing for direct marketing purposes;
• Right to withdraw consent: at any time, without affecting the lawfulness of processing carried out before withdrawal;
• Right not to be subject to fully automated decisions producing legal effects or similarly significant effects, save where permitted by law (see Section 14).

Requests may be submitted, free of charge and without specific formalities, to:

• Email: [email protected]
• Postal address: Foster Capital Inc, Robin Kelton Bldg, Choc Bay, P.O. Box GM763, Castries, Saint Lucia

The Company will respond within 30 days of receipt of the request. This period may be extended where the request is complex or numerous, in which case you will be informed of the extension and the reasons for the delay.

Right to lodge a complaint. You have the right to lodge a complaint with the competent data protection authority of your country of residence, where applicable, or with the data protection authority of Saint Lucia.

12. Cookies and Tracking Technologies

The Website uses cookies and similar tracking technologies, including strictly necessary cookies, analytics cookies and, subject to consent, profiling and marketing cookies. For full details on the categories, purposes, duration, third-party recipients and means of managing your preferences, please refer to our Cookie Policy, which forms an integral part of this Privacy Policy.

You may modify or withdraw your consent at any time through the preference management panel available on the Website.

13. Embedded Content from Other Websites

Pages of the Website may include content embedded from third-party websites (for example, videos, images, social media widgets). Such embedded content behaves as if the user had visited the third-party website directly. These third parties may independently collect data about your interaction, use cookies and other tracking technologies, in accordance with their own privacy policies. The Company encourages you to review the privacy notices of the websites from which such content originates.

14. Automated Decision-Making and Profiling

Within the context of fraud prevention, anti-money laundering screening and risk assessment, the Company may use automated decision-making tools and profiling. In such cases, you have the right to request human intervention, to express your point of view and to contest the decision. Decisions are not based solely on automated processing where this would produce legal or similarly significant effects without an opportunity for human review.

15. Minors

The Services are not intended for, and are not directed at, individuals under the age of 18 years. The Company does not knowingly collect personal data from minors. Should it come to the Company's attention that personal data of a minor has been collected, such data will be promptly deleted. If you believe that we may have collected personal data from a minor, please contact us at [email protected].

16. Security

The Company implements appropriate technical, physical and organisational security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. However, no method of transmission over the internet or method of electronic storage is fully secure. While we strive to use commercially reasonable means to protect your personal data, we cannot guarantee its absolute security.

In the event of a personal data breach likely to result in a risk to the rights and freedoms of affected individuals, the Company will take all reasonable steps to mitigate the breach and notify the affected individuals and competent authorities where required by applicable law.

17. Third-Party Links

The Website may contain links to third-party websites operated by entities not affiliated with the Company. The Company is not responsible for the privacy practices or the content of such third-party websites. We encourage you to review the privacy policies of any third-party site before providing them with your personal data.

18. Changes to this Privacy Policy

The Company reserves the right to amend or update this Policy from time to time, including to reflect changes in law, regulation or business practice. Updated versions will be published on the Website with a revised "Last updated" date. Where material changes are made, the Company will provide notice to users through the Website or by email. Continued use of the Services following such notice constitutes acceptance of the revised Policy.

19. Contact Us

If you have any questions, comments or concerns about this Policy or about the way the Company processes your personal data, please contact us at:

Osher LTD
Foster Capital Inc, Robin Kelton Bldg, Choc Bay, P.O. Box GM763, Castries, Saint Lucia
Email: [email protected]
Website: https://osherltd.com

This Privacy Policy is governed by the laws of Saint Lucia. Any dispute arising in connection with this Policy shall be subject to the exclusive jurisdiction of the courts of Saint Lucia, without prejudice to any mandatory rights of consumers under the law of their country of residence.