SEC Regulation S-P

Privacy of Consumer Financial Information and Safeguarding Customer Information

Purpose

Doo Financial US, Inc. (“the Firm”) is committed to protecting the privacy, confidentiality, and security of customer information. The Firm has adopted this Privacy Policy to comply with SEC Regulation S-P and other applicable federal privacy requirements governing the collection, use, protection, and safeguarding of customer information.

The Firm maintains administrative, technical, and physical safeguards reasonably designed to:

• Ensure the security and confidentiality of customer information;
• Protect against anticipated threats or hazards to customer information;
• Protect against unauthorized access to or use of customer information that could result in substantial harm or inconvenience to customers; and
• Ensure the proper disposal of customer information.

Scope

This policy applies to all employees, officers, contractors, temporary personnel, and service providers who have access to customer information.

The requirements apply to individual customer accounts, including U.S. and foreign customers, and govern all nonpublic personal information (“NPPI”) maintained by the Firm.

Nonpublic Personal Information (NPPI)

NPPI includes personally identifiable financial information that is provided by a customer, obtained in connection with providing financial products or services, or otherwise maintained by the Firm, and which is not publicly available.

Public information does not include information that is lawfully obtained from:

• Federal, state, or local government records;
• Widely distributed media; or
• Disclosures required by applicable law.

Customer Privacy Notice

The Firm provides each customer with its Privacy Notice at the time an account is established.

Thereafter, the Firm provides updated Privacy Notices as required by applicable law. If the Firm qualifies for the annual privacy notice exception under Regulation S-P and its information-sharing practices have not changed, an annual notice is not required.

Customers are provided any required opportunity to opt out of information sharing with nonaffiliated third parties as required by law.

Employee Responsibilities

All employees have an affirmative obligation to safeguard customer information.

Employees may access customer information only as necessary to perform their assigned job responsibilities.

Employees are prohibited from:

• Disclosing NPPI to unauthorized persons;
• Sending customer information to personal email accounts;
• Downloading customer information onto unauthorized devices;
• Removing confidential information from Firm premises without authorization;
• Sharing passwords or system credentials;
• Discussing customer information in public areas;
• Accessing customer information without a legitimate business purpose.

Violations of this policy may result in disciplinary action up to and including termination.

Administrative, Technical and Physical Safeguards

The Firm maintains safeguards designed to protect customer information, including:

Administrative Controls

• Written supervisory procedures governing customer information;
• Employee privacy and cybersecurity training;
• Background screening where appropriate;
• Role-based access controls;
• Periodic review of employee access rights;
• Vendor due diligence and oversight;
• Periodic privacy and cybersecurity risk assessments.

Technical Controls

• Password-protected systems;
• Multi-factor authentication where appropriate;
• Encryption of customer information during transmission and, where feasible, while stored;
• Current operating system and software patch management;
• Antivirus and endpoint protection;
• Logging and monitoring of system activity;
• Secure cloud storage providers;
• Prompt removal of user access following employee termination or role changes.

Physical Controls

• Secure office facilities;
• Restricted access to confidential records;
• Secure storage of paper files;
• Shredding or secure destruction of customer information;
• Protection against unauthorized visitor access.

Electronic Information Security

Customer information maintained electronically shall be stored only on Firm-approved systems.

The Firm utilizes secure cloud-based service providers to store customer information. The Firm performs appropriate due diligence and oversight of these providers to ensure reasonable safeguards are maintained to protect customer information.

Employees shall not store customer information on unauthorized personal devices or cloud storage applications.

Incident Reporting and Response

Employees must immediately report any actual or suspected:

• Unauthorized access;
• Loss of customer information;
• Cybersecurity incident;
• Data breach; or
• Privacy violation

to the Chief Compliance Officer or designated Information Security Officer.

The Firm will promptly investigate reported incidents and take appropriate steps to:

• Contain and mitigate the incident;
• Preserve relevant evidence;
• Determine whether customer notification is required;
• Notify regulators when required;
• Document corrective actions; and
• Update security controls when appropriate.

Service Provider Oversight

The Firm exercises appropriate oversight over third-party vendors that receive, maintain, process, or otherwise have access to customer information.

Service providers are expected to maintain safeguards designed to protect customer information consistent with applicable legal and regulatory requirements.

Disposal of Customer Information

Customer information shall be disposed of in a manner that prevents unauthorized access.

Approved disposal methods include:

• Cross-cut shredding;
• Secure destruction services;
• Secure electronic deletion; and
• Media sanitization before disposal or reassignment.

Record Retention

Privacy-related records, employee training records, incident documentation, vendor due diligence, and safeguarding documentation shall be maintained in accordance with SEC Rule 17a-4 and the Firm’s Record Retention Policy.

Questions

Questions regarding this policy or the handling of customer information should be directed immediately to the Chief Compliance Officer before any customer information is disclosed.

All personnel are expected to understand and comply with this policy as a condition of employment.