Last Updated: February 2026

1. Introduction

At SURA PTY LTD, we are committed to protecting your privacy and ensuring the security of your personal data. This comprehensive privacy policy explains how we collect, use, store, and protect your personal information when you use our financial services, visit our website, or interact with us in any way.

This policy covers all aspects of our data processing practices, including financial data protection, compliance with German and European data protection laws (GDPR), and adherence to international financial standards. By using our services or providing us with your personal data, you agree to the terms outlined in this privacy policy.

Important note: We never sell your personal data to third parties. Your financial privacy is of utmost importance to our business relationship.

2. Information we collect

2.1 Information you provide

• Personal identification information: Full name, date of birth, identification numbers, nationality
• Contact information: Email address, phone numbers, home and business addresses
• Financial information: Bank account details, income verification, tax information, employment data
• Account credentials: Usernames, encrypted passwords, security settings
• Transaction history: Service applications, payment records, agreements, portfolios
• Communication records: Customer service interactions, feedback, survey responses
• Marketing preferences: Communication preferences, newsletter subscriptions

2.2 Automatically collected information

• Device information: IP address, browser type, operating system, device IDs
• Usage data: Pages visited, time spent, click patterns, search queries
• Location data: Approximate geographic location based on IP address
• Cookie data: Session IDs, user preferences, analytics data
• Transaction metadata: Timestamps, transaction amounts, payment methods

2.3 Information from third parties

• Credit reference agencies: Credit scores, credit reports, payment history
• Financial institutions: Account statements, account verification
• Payment processors: Payment confirmation, fraud alerts
• Government authorities: Tax information, reporting obligations
• Business partners: Referral information, joint account details

3. How we use your data

3.1 Financial services

• Account management: Opening, maintaining, and closing customer accounts
• Service delivery: Assessing applications, determining eligibility
• Risk assessment: Analyzing financial stability, fraud prevention
• Payment processing: Executing transactions, maintaining records
• Customer service: Providing support, resolving disputes

3.2 Legal and regulatory compliance

• KYC compliance: Verifying customer identity according to legal requirements
• AML monitoring: Screening for suspicious activity
• Tax reporting: Fulfilling tax obligations
• Regulatory reporting: Submitting required reports to authorities
• Legal requests: Responding to court orders and lawful government requests

3.3 Communication and customer service

• Transaction notifications: Sending account alerts and payment confirmations
• Policy updates: Informing you about changes to terms and policies
• Security alerts: Notifying you about suspicious activity
• Customer surveys: Gathering feedback to improve service quality

3.4 Marketing and business development (with consent)

• Product recommendations: Suggestions for relevant financial products
• Promotional communications: Sending newsletters, market insights
• Market research: Analyzing trends to develop new services
• Performance analysis: Measuring campaign effectiveness

4. Information sharing and disclosure

4.1 Financial service providers

• Banking partners: Secure transmission of account and transaction data
• Credit reference agencies: Exchanging credit-related information
• Payment processors: Encrypted payment information
• Insurance providers: Relevant data for insurance products
• Asset managers: Portfolio data for advisory services

4.2 Legal and regulatory requirements

• Court orders: Complying with judicial instructions
• Regulatory authorities: Reporting obligations to BaFin, ECB, and other supervisory bodies
• Tax authorities: Providing information required for tax compliance
• Law enforcement: Cooperating with legitimate investigations
• Anti-money laundering: Reporting suspicious transactions

4.3 Corporate transactions and mergers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the new entity. We will notify you before your personal data becomes subject to a different privacy policy, and you will have the option to object to the transfer or request deletion of your data, where legally permissible.

4.4 With your explicit consent

We will share your data with third parties when you have given us your explicit consent to do so, for example, when you request specific services that require data sharing with our partners.

5. Data security and protection measures

5.1 Technical security measures

• Advanced encryption: AES-256 encryption for data at rest, TLS 1.3 for data in transit
• Multi-factor authentication: Required for administrative access and customer accounts
• Network security: Enterprise-grade firewalls, intrusion detection systems
• Access controls: Role-based permissions, regular access reviews
• Data backup: Encrypted, geographically distributed backups
• Security monitoring: 24/7 monitoring, automated threat detection

5.2 Organizational security measures

• Employee training: Mandatory security awareness training
• Background checks: Comprehensive employee screening
• Confidentiality agreements: Legal obligations for all employees
• Security policies: Comprehensive information security management system
• Regular audits: Internal and external security assessments
• Incident response: Detailed procedures for security breach response

5.3 Your security responsibility

• Secure passwords: Use unique, complex passwords
• Device security: Keep your devices updated and use security software
• Secure connections: Only access your account from trusted networks
• Logout practices: Always fully log out on shared devices
• Phishing awareness: Be cautious of suspicious communications
• Immediate reporting: Contact us if you suspect unauthorized access

5.4 Data breach notification

In the unlikely event of a data breach that could affect your personal data, we will notify you and the relevant supervisory authorities in accordance with the GDPR within 72 hours of becoming aware of the breach. We will provide you with comprehensive information about what happened and the steps we are taking.

6. Cookies and tracking technologies