Privacy Policy

We, Kristal Advisors (SG) Pte Ltd or Kristal.AI Middle East Limited and other members of the Kristal Group (as defined below) (collectively referred to as "Kristal.AI", “we”, “us”, “our” hereinafter) recognize the importance of safeguarding your personal data and are committed to protecting your personal data under the Abu Dhabi Global Market (ADGM) Data Protection Regulations 2021(ADGM DPR) or the Personal Data Protection Act, 2012 (Singapore). Where applicable, we may also comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (the “GDPR”).

The Services, Platform and Applications (all, as defined hereinbelow) are owned and operated by Kristal.AI, where such expression shall, unless repugnant to the context thereof, be deemed to include its respective representatives, administrators, employees, directors, officers, agents and their successors and assigns.

By accessing, using and/or registering for the Platform, Services and/or Applications, whether directly through a mobile device, mobile application or computer, or indirectly through third parties, the User (as defined below) agrees to be bound by the terms of service (the “Terms of Service”), the client agreement signed between Kristal.AI and the User for availing the Services (the “Client Agreement”) and this Privacy Policy (the “Policy”) and is deemed to have provided consent to Kristal.AI’s collection, use, disclosure and processing of Personal Data (as defined below), regardless of whether the User creates an account/login credentials to avail of the Services.

This Policy (together with the Terms of Service, Client Agreement and any other document(s) referred to in the Terms of Service and the Client Agreement) sets out the basis on which any Personal Data we collect from you, or that you provide to us, will be collected, used, disclosed and processed by us. Please read the following carefully to understand our views and practices regarding your Personal Data and how we will treat it.

Kristal.AI is a controller of the Personal Data collected from you through the Platform, Services and/or the Application.

The headings of each section in the Policy are only for the purpose of organizing the various provisions under the Policy in an orderly manner and shall not be used by either Party (as defined below) to interpret the provisions contained herein in any manner. Further, it is specifically agreed to by the Parties (as defined below) that the headings shall have no legal or contractual value.

Please notify us and stop using our Services immediately if you do not consent to this Policy.

“Application”, singular or plural, refers to any of our html-based / internet-based computer programs, smart phone, tablet or personal computer applications and all other software programs made available to Users by us.

“Content” means (1) any information, data, text, software, code, scripts, music, sound, photos, graphics, videos, messages, tags, interactive features, or other materials that you post, upload, share, submit, or otherwise provide in any manner to the Platform; and (2) any other materials, content, or data you provide through any channel to Kristal.AI.

“Core Data” means statistical collective data amongst users produced by the Kristal Group as part of the Service.

“Customers” means registered Users of the Platform who have completed the onboarding procedure comprising but not limited to Know Your Customer (“KYC”) checks and risk profiling. For the avoidance of doubt, Users who are simply accessing information on the Platform or Users who have completed the “sign-up” process but not the KYC checks and risk profiling process are not Customers.

“Intellectual Property” means the technology and Content of the Services, including, but not limited to, the “look and feel” (such as text, graphics, images, illustrations, logos, button icons) of our Platform, Applications and all other material, Core Data, photographs, videos, tutorials, editorial content, notices, software and other content, that are the property of the Kristal Group (and/or its licensors), which is protected by copyright, trademark, patent and other intellectual property laws in all applicable jurisdictions.

“Kristal Group” includes Kristal.AI and any company which may from time to time be established and which may fall under the majority ownership and control of the officers of Kristal.AI including the parent or holding company and any subsidiary and any company which has a strategic or operational partnership agreement with the Company. Kristal Group shall include without limitation the following: O2O Technologies Pte Limited, O2O Software Services Private Limited, Kristal.AI Technologies Ltd, Kristal.AI Capital Private Limited, Kristal Advisors Private Limited, Kristal Advisors (HK) Ltd, Kristal.AI Holdings Pte. Ltd, Kristal.AI Middle East Limited.

“Kristals” are the strategies or products the Customer may invest in. The singular form is referred to as “Kristal”.

“Opt-Out” means (as the case may be) a tick on our login page indicating your refusal to our use of your Personal Data and the mechanism explained in Clause 9.

“Party” refers individually to each of you and the Kristal Group.

“Parties” refer to both you and the Kristal Group collectively.

"Personal Data" means any information related to a natural person, or ‘Data Subject’, that can be used to directly or indirectly identify the person and includes your name, address, identification number, phone number, payment details and/or other information by which you may be personally identified, your IP address, cookies, third party’s cookies and web pages that have been viewed by you.

"Personal Financial Data" means financial account statements and other financial data that you provide to us or authorize us to have access in order to deliver the Services to which you have subscribed.

"Platform" means www.kristal.ai or such website or any other mobile application powered by O2O Technologies Pte Ltd to provide Services, but does not include any website or mobile application owned or operated by a third party that may be accessed from any page on www.kristal.ai or mobile application powered by O2O Technologies Pte Ltd.

"Services" means the account aggregation, portfolio visualization, advisory, transaction execution, order management, analytics and reporting services and other services made available by the Kristal Group in relation to the investments made by the Customer in one or more Kristals. Apart from investments made by the Customer in Kristal(s), Services also includes Kristal Group acting as a referrer to identify and refer prospective clients to other third-party services and/or platforms and the conducting of events or the provision of information via third party service providers. Services offered may vary across jurisdictions. It is clarified that the use of the Platform and Services shall be subject to the fees payable by you in accordance with the Client Agreement ("Fees").

"User" capitalized or otherwise, means the person who accesses and/or uses the Services, and, if authorized and applicable, the entity on whose behalf any person accesses or uses the Services and includes users who access the internal/BackOffice, RM App/enterprise solution and client portal / iOS and android App powered by us. It is clarified that the term User shall include all Customers, our employees, any intermediatory and their representatives.

"You" capitalized or otherwise means the User or Customer. "Your", capitalized or otherwise, has a corresponding meaning.

1.1 In order to provide Services to you, we may collect, use, process, or disclose the following data about you:

1. (a) information that you provide by filling in forms on the Platform or through another remote channel or sent to us physically. This includes information provided at the time of registering to use the Platform, our Services, posting material or requesting further Services from us. We may also ask you for information at other times, for example in connection with a promotion or when you report a problem with the Platform;
2. (b) information that you provide by filling in forms or through other means on third party websites or applications which we may engage with for the provision of Services;
3. (c) if you contact us, we may keep a record of that correspondence;
4. (d) we may also ask you to complete surveys that we use for research purposes, although you do not have to respond to them;
5. (e) details of transactions you carry out through the Platform and of the fulfilment of your orders;
6. (f) details of your visits to the Platform and the resources that you access;
7. (g) documents uploaded onto the Platform; and
8. (h) details of bank / broker accounts which you link to our Platform.

(Clauses 1.1 (a) to (g) shall together be referred to as "Additional Information")

1.2 You agree that if you send us personal correspondence, such as emails or letters, or if other users or third parties send us correspondence about your activities or postings on the Platform, we may collect and/or store such information.

1.3 The regulations applicable to you will be based on the booking center i.e. Kristal.AI Middle East Limited (“Kristal UAE”) or Kristal Advisors (SG) Pte. Ltd. (“Kristal SGP”), as applicable, you are onboarded (the “Booking Centre”). The Customers shall be able to view the Booking Center in the welcome letter generated once the Customer completes the process of onboarding.

1. 2.1 By using our Services, making an application or accessing the Platform, you grant us the permission to collect, use, copy, transmit, store and back-up your Personal Data for purposes of the Services and/or for any other purpose(s) as contemplated by the Policy and the Terms of Service and the Client Agreement. This is subject to the restrictions in Clause 8.
2. 2.2 We shall not be responsible for the authenticity of the Personal Data or any other information supplied by you to us or any other person acting on our behalf.
3. 2.3 The purposes for which Personal Data may be used by us include:
   1. (a) Conducting anti-fraud, anti-money laundering and countering of terrorism financing (“AML/CFT”) and identity verification and authentication KYC checks;
   2. (b) ensuring that the content(s) of the Platform are presented in the most effective manner for you and for your computers and other devices;
   3. (c) analysing your financial standing to determine products that are suitable for you;
   4. (d) for the provision of Services;
   5. (e) sharing of Personal Data with third parties that we may engage with solely for the purposes of providing you with Services;
   6. (f) providing you with alerts, newsletters, education materials or information that you have requested or signed up to;
   7. (g) carrying out our obligations arising from any contracts entered into between you and us;
   8. (h) allowing you to participate in interactive features of our Services, when you choose to do so;
   9. (i) complying with laws and regulations applicable to us or any of our affiliates in any applicable jurisdiction;
   10. (j) legal proceedings, including collecting overdue amounts and seeking professional advice;
   11. (k) improving and furthering our products;
   12. (l) promoting and marketing our Services and products subject to your exercise of the Opt-Out; or
   13. (m) purposes directly related or incidental to any of the above.
4. 2.4 We process your Personal Data for these purposes on the following legal basis: (a) it is necessary for the performance of the contract of providing the Services to you or in order to take steps at your request prior to entering into the contract; (b) to comply with our legal and regulatory obligations; (c) to protect our legitimate interest in responding to your queries and providing Services and/or information to you; (d) with your consent. Where you have consented to the processing of your Personal Data you may withdraw your consent at any time, by contacting compliance@kristal.ai for Customers onboarded to Kristal Advisors (SG) Pte. Ltd. and kamel-compliance@kristal.ai for Customers onboarded to Kristal.AI Middle East Limited. You can object to processing based on our legitimate interest at any time by contacting us at those addresses. Please also check Clause 10 for the details.
5. 2.5 We will keep the Personal Data we hold confidential and take steps to prevent unauthorized disclosures, but we may disclose such information (and you are deemed to have consented to such disclosure) to: (a) personnel, employees, agents, advisers, auditors, contractors, financial institutions, and service providers to the extent reasonably necessary for the provision and maintenance of the Services; (b) third parties, including service providers, agents or contractors under a duty of confidentiality to us; (c) our overseas offices, affiliates, business partners and counterparts; (d) the requisite persons in order to investigate, prevent or take action regarding illegal activities, suspected fraud, potential threats to physical safety, or violation of the Terms of Service or the Policy; (e) persons under a duty of confidentiality to us; (f) persons to whom we are required to make disclosure under applicable laws and regulations; or (g) actual or proposed transferees or participants of our Services.
6. 2.6 Core Data: For producing Core Data, we may aggregate your Personal Financial Data together with similar data from other Users. Core Data will be produced in such a manner that the underlying data will be anonymized or pseudonymized and no longer be identifiable to any specific User. We may share Core Data amongst Users as part of the Services provided, and also with our business partners and other third parties to help us make improvements and/or enhancements to our products and Services and for marketing, research and academic purposes.
7. 2.7 Third Parties: We work with third-party service providers in order to provide Services to you. We may disclose or share your Personal Data with such third-party service providers. These providers may have access to or process your Personal Data for the purpose of providing services for us. You agree and acknowledge that where your Personal Data is shared with such third parties, it shall be subject to and processed in accordance with such third party’s privacy policy.

3.1 We may automatically track certain information about you based upon your behavior on our Platform or while accessing our Services. You agree that we may use such information to do internal research on our Users' demographics, interests, and behavior to better understand, protect and serve our Users. This information is compiled and analyzed on an aggregated basis.

3.2 The Platform uses cookies to distinguish you from other Users of the Platform. This helps us to provide you with a good experience when you browse the Platform and also allows us to improve the Platform. By continuing to browse the Platform, you are agreeing to our use of cookies. Usage of a cookie is in no way linked to any personally identifiable information on our Platform.

3.3 A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer and of your other device if you agree. Cookies contain information that is transferred to your computer's hard drive.

3.4 You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies, you may not be able to access all or parts of the Platform. If you do not consent to our use of cookies, you should adjust your browser settings accordingly or not use any of the Services.

3.5 We use the following cookies:

1. (a) Strictly necessary cookies. These are required for the operation of the Platform. They include, for example, cookies that enable you to log into secure areas of the Platform.
2. (b) Analytical / performance cookies. They allow us to recognize and count the number of visitors and to see how visitors move around the Platform when they are using it. This helps us to improve the way the Platform works.
3. (c) Functionality cookies. These are used to recognize you when you return to the Platform. This enables us to personalize our content for you, greet you by name and remember your preferences (for example, your choice of language or region).

3.6 Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which we have no control. This Privacy Policy does not cover the use of cookies by any third parties, and we are not responsible for their privacy policies and practices.

4.1 We may use third-party web analytics services on the Platform. The service providers that administer these services use technologies such as cookies, web server logs and web beacons to help us analyze how visitors use the Platform. The information collected through these means (including IP address) is disclosed to these service providers, who use the information to evaluate use of the Platform.

4.2 Google Analytics

1. (a) Google Analytics is a web analysis service provided by Google Inc. ("Google"). Google's ability to use and share information collected by Google Analytics is in accordance with its policies: http://www.google.com/policies/privacy/partners/
2. (b) You can prevent Google’s collection and processing of data by using the Google Ads Settings page or by downloading and installing its browser plug-in (https://tools.google.com/dlpage/gaoptout).

5.1 What we do

(a) We are committed to the safety and security of your Personal Data. We use a world class cloud infrastructure provider for storing all information and for hosting the Platform. We place your Personal Data in an encrypted database and file system and deploy firewalls, SSL and encryption technology for data transmission.

(b) We may hold your Personal Data on servers in Singapore, Australia, Hong Kong, India and/or any other territories in order to comply with the applicable law. We may also transfer your Personal Data to our overseas offices or to any of the persons listed in clause 2.5 above, who may be located in any part of the world. Such transfers are undertaken in accordance with applicable laws and regulatory obligations. Please refer to Clause 8 for the details.

(c) We subject ourselves to regular checks by third party security evaluation specialists and restrict access to your Personal Data by our staff on a need-to-know basis only. Once we have received your Personal Data, we will use strict procedures and security features to try to prevent, as far as is reasonably possible, unauthorized access to your Personal Data.

(d) You accordingly agree that we shall not be held liable for any accidental dissemination of Personal Data that has occurred in spite of our best efforts and procedures to maintain confidentiality.

5.2 What you should and should not do

You should keep your user ID / username and password strictly confidential at all times and should not share these details with anyone. In public areas, you should exercise caution and not leave your computer / device unattended especially whilst logged into your account. The use of established malware and virus protection software and apps for your device is recommended. You should also avoid using public computer terminals to access your account. We will not be liable for any loss or damage arising from unauthorized access to your account due to any failure to comply with these precautions.

By using the Platform, you agree to the terms of this Policy. We may revise the terms of this Policy from time to time and will always present the most up-to-date version on our Platform. It is your responsibility to periodically review and keep yourself appraised of the latest terms but, if any revision meaningfully affects your rights, we will take reasonable steps to notify you of such changes.

Our Services and Platform may contain links to third party applications / websites. Please note that when you click on one of these links, you are entering another application / website over which we have no control and will bear no responsibility. Often these applications / websites require you to enter your Personal Data and further use and collect your Personal Data. We encourage you to read the privacy statements / policies on all such applications / websites as their policies may differ from our Policy and Terms of Service. You agree that we shall not be liable for any breach of your privacy of Personal Data or loss incurred by your use of these applications / websites.

8.1 We retain Personal Data for as long as it is necessary. It may be archived as long as we believe that the purpose for which it was used still exists. We will retain your Personal Data until the purpose for which it was collected is no longer being served by its retention, and it does not need to be retained any longer for any legal or business purpose. If any part of the Personal Data has been collected as part of our AML/CFT measures, we may retain such Personal Data for at least six (6) years after the termination of the business relationship with you.

8.2 If you decide to stop using our Services, we will delete all your Personal Data within a reasonable time after the termination of the Services, subject to retention for purposes of complying with applicable laws, resolving disputes, enforcing the terms of our agreement with you and protecting our legitimate interests.

8.3 Sometimes, the Personal Data we collect may be retained, transferred, or processed outside the territory you are situated in. We will take measures reasonably within our means to ensure that the recipient(s) of your Personal Data located outside your territory will provide an adequate level of protection. In order to provide you with the Services, you are deemed to consent to such transfer, storage, or processing in providing your Personal Data to us during your use of the Platform.

8.4 We will only transfer your Personal Data outside of the ADGM or EEA where applicable: (a) where the transfer is to a place regarded by the ADGM Commissioner or European Commissioner as providing adequate protection for your Personal Data; (b) where we have put in place appropriate safeguards (for example where both parties have signed standard data protection clauses); or (c) where we are still legally permitted to do so, for example if the transfer is necessary for the performance of a contract, the establishment/exercise/defense of legal claims, or with your consent. You can request further detail about the safeguards by contacting us at kamel-compliance@kristal.ai.

8.5 Where your Personal Data must be shared with third parties in circumstances not reasonably contemplated within the normal course of our dealings with you, we would usually first seek your consent unless the disclosure: (a) is required or authorised based on applicable laws and/or regulations; (b) is clearly in your interests and consent cannot be obtained in a timely way; (c) is necessary to respond to an emergency that threatens the life, health or safety of yourself or another individual; (d) is necessary for any investigation or proceedings; (e) is required by a law enforcement agency; (f) is to a public agency and necessary in the public interest; and/or (g) is otherwise permitted by law.

8.6 If you are a resident of the EU, and if we do store any of your data in the EEA, when we transfer the data outside the EEA this is done either on the basis that it is necessary for the performance of the agreement with you, or that the transfer is subject to the applicable laws in the EU or under the GDPR.

9.1 We intend to use your Personal Data and Additional Information in direct marketing. You have the right to object at any time to the processing, including profiling, of your Personal Data for such direct marketing purposes. We may also provide your Personal Data to Trusted Associates under Schedule 4 of the Client Agreement for their use in direct marketing.

9.2 As further explanation, please note that: (a) the following classes of services, products and subjects may be marketed in direct marketing: (i) our Services and products related to the Platform and/or our affiliates; and (ii) invitations to events such as webinars, seminars, round tables and talks; (b) we may conduct direct marketing via fax, email, direct mail, telephone and other means of communication or send e-newsletters to you.

9.3 HOWEVER, we will not do so without your consent and request that you provide the same by ticking the box on our Platform login page. If you decide not to tick the box, you are indicating that you DO NOT wish Kristal.AI to use your Personal Data in direct marketing, DO NOT wish to receive direct marketing materials, and DO NOT wish Kristal.AI to provide your Personal Data to any other persons for their use in direct marketing — except where you have applied for any product or service provided by Kristal.AI jointly with a co-branding partner, in which case the Opt-Out will not apply to such co-branding partner to whom you have consented to the provision of your Personal Data separately.

You may have the following rights in relation to your Personal Data (under the ADGM DPR or, if you are a resident of the EU, under the GDPR):

10.1 Right to information. You are entitled to request confirmation from us at any time as to whether we are processing your Personal Data. If so, you are also entitled to receive information about such Personal Data and other specific information including the contact details of the controller and the purposes and legal bases for processing your Personal Data.

10.2 Right to erase the information ("Right to be forgotten"). You may request that we delete the data we hold about you where: (a) our continued holding of your personal data is no longer necessary for the purposes for which it was collected; (b) having provided your consent earlier, you now wish to withdraw it and there is no other legal ground under which we can process the data; (c) you do not wish to receive updates, news about promotions or marketing materials from us that have been customized using data we have about you; or (d) the data we hold about you have been unlawfully processed.

10.3 Right to rectify the information. You shall have the right to obtain the rectification of inaccurate or incorrect Personal Data concerning you.

10.4 Right to restrict the processing of the information. You have a right to require us to stop processing the data we hold about you other than for storage purposes in certain circumstances. However, if we stop processing the data, we may use it again if there are valid grounds under applicable laws, including laws relating to AML/CFT.

10.5 You may request us to stop processing your Personal Data and only store it if: (a) you contest the accuracy of the Personal Data, for the period it takes for us to verify it; (b) you are of the view that the processing is unlawful and you only want us to restrict its use; (c) we wish to erase the Personal Data as it is no longer necessary for our purposes, but you require it to be stored for the establishment, exercise or defence of legal claims; or (d) you have objected to us processing the Personal Data, pending verification whether our legitimate grounds override yours.

10.6 Right to data portability. You shall have the right to receive the Personal Data concerning you which you have provided to us in a structured, current and machine-readable format, and the right to transmit those data to another controller or processor.

10.7 Right to object. You have the right to object to certain types of processing, on grounds relating to your particular situation, at any time insofar as that processing takes place for the purposes of legitimate interests pursued by us or a third party. We may continue to process your Personal Data if we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or we need it for the establishment, exercise or defense of legal claims.

10.8 Right to limitation of processing. Under certain conditions you are entitled to request from us the limitation of the processing of your Personal Data.

10.9 Right of revocation. You have the right to revoke your consent to the processing of your Personal Data at any time with effect for the future.

10.10 The right in relation to automated decision making and profiling. You have the right not to be subject to a decision by us based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless you have given your explicit consent or unless otherwise permitted under the GDPR.

10.11 You can exercise the above rights by writing to us at compliance@kristal.ai for Customers onboarded to Kristal Advisors (SG) Pte. Ltd. and kamel-compliance@kristal.ai for Customers onboarded to Kristal.AI Middle East Limited.

10.12 In addition to the rights listed above, should you consider that we do not comply with the applicable data protection laws and/or regulations, or have concerns with regard to the protection of your Personal Data, you are entitled to lodge a complaint with the ADGM Commissioner.

In the event you have any grievances or questions about the Policy, or if you wish to make a complaint regarding any violation of the provisions of the Policy and the way your Personal Data is processed, you may contact us at the details set out below:

For Users whose Booking Center is Kristal Advisors (SG) Pte. Ltd.
Name: Vishi Rajvanshi
Email: vishi.rajvanshi@kristal.ai

For Users whose Booking Center is Kristal.AI Middle East Limited
Name: Prateek Gupta
Email: prateek@kristal.ai

For Users who are residents of the European Union
Name of Controller: Srinivas Handadi — srinivas.handadi@kristal.ai
Name of EU Representative: Srinivas Handadi — srinivas.handadi@kristal.ai