DATA PROTECTION POLICY – for MCS Website

Last Updated: 15th October 2025

1. Introduction

At My Corporate Strategy Ltd (“MCS”, “we”, “our”, “us”), we recognise that protecting personal data is fundamental to maintaining trust and fulfilling our legal and ethical

responsibilities. This Data Protection Policy outlines the principles and commitments that guide MCS in ensuring that personal information is collected, used, retained, and disclosed in a lawful, fair, and transparent manner.

MCS is fully committed to complying with all applicable data protection and privacy legislation, including the Data Protection Act 2017, European Union General Data Protection Regulation (GDPR) , the Financial Intelligence and Anti-Money Laundering Act 2002 (FIAMLA), the Financial Crimes Commission Act, the Companies Act, the Finance Act and any other relevant local or international prevailing standards as applicable.

In all circumstances, compliance with legal and regulatory requirements prevails over business interests.

2. Fair and Lawful Processing

MCS processes personal data responsibly, ensuring that the rights and interests of individuals are respected at all times. All data collection and processing activities are conducted lawfully, fairly, and transparently, and only for clearly defined and legitimate purposes.

3. Purpose and Limitation of Use

Personal data shall be collected and processed solely for specific and legitimate business or regulatory purposes, such as:

• Providing professional services (Company Secretarial, Compliance, Accounting, Tax, Strategic Consultancy, Insolvency);
• Meeting legal and regulatory obligations (including AML/CFT and reporting requirements);
• Managing client relationships and communication; and
• Internal record-keeping, billing, and audit purposes.

MCS will not process personal data for any purpose incompatible with its original purpose unless authorised by law or with the individual’s consent.

4. Transparency and Communication

 MCS ensures that data subjects are clearly informed about:

• The identity and contact details of the Company and its Data Protection Officer;
• The purpose and legal basis of processing;
• The categories of data collected;
• The intended recipients or classes of recipients; and
• The retention period or criteria used to determine it.

Where required, MCS will provide this information at the time of data collection or as soon as reasonably practicable thereafter.

5. Data Minimisation and Necessity

MCS limits data collection to the minimum amount of information necessary to achieve the intended purpose. Where possible and appropriate, anonymised or pseudonymised data will be used. Personal data will not be collected or retained on a speculative basis for future use.

6. Accuracy and Integrity

MCS strives to ensure that personal data is accurate, complete, and up to date. Where data is found to be incorrect or outdated, reasonable steps shall be taken to rectify or remove it promptly.

7. Retention and Deletion

Personal data will be retained only for as long as required by law or for legitimate business purposes. Retention periods are determined by reference to statutory requirements under legislation such as FIAMLA, the Companies Act, and the Income Tax Act. Once data is no longer required, it shall be securely deleted, anonymised, or otherwise rendered permanently inaccessible.

8. Confidentiality and Data Security

MCS takes all reasonable steps to maintain the confidentiality, integrity, and security of personal data. Appropriate technical, physical, and organisational measures are implemented to safeguard data against unauthorised access, loss, alteration, misuse, or disclosure.

Access to personal data is restricted to authorised personnel who have a legitimate need to know and are bound by confidentiality obligations.

9. Accountability and Governance

MCS promotes a culture of accountability in data protection. All employees, consultants, and officers of MCS share responsibility for ensuring that personal data is handled in compliance with this Policy.

MCS undertakes to:

• Embed data protection considerations into business processes (“privacy by design and by default”);
• Conduct internal reviews and risk assessments where necessary;
• Provide regular staff training and awareness sessions; and
• Maintain records of processing activities as required under law.

10. Review and Amendments

This Policy will be reviewed periodically to ensure its continued effectiveness and relevance to evolving legal, technological, and operational requirements. Any updates will be reflected on this page with an amended “Last Updated” date.