Privacy Policy

SCO AMERICA ("SCO AMERICA," "we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our institutional custody services, digital platform, and related financial services.

1. Information We Collect

1.1 Personal and Identity Information

• Identity: Full legal name, date of birth, nationality, government-issued ID details
• Contact: Business and residential addresses, email addresses, telephone numbers
• Financial: Bank account details, portfolio information, transaction history, assets under custody
• Professional: Employment details, business registration, authorised signatories, beneficial ownership
• Verification: Certified corporate documents, regulatory licences, source of funds documentation

1.2 Technical Information

When you access our Digital Platform, we automatically collect IP addresses, device identifiers, browser type and operating system, access times, login credentials and session data, and platform usage patterns for security and performance purposes.

1.3 Transaction Data

We maintain comprehensive records of all custody and settlement transactions, including securities holdings and movements, cash transactions and FX exchanges, corporate action elections, and all settlement instructions and confirmations.

2. How We Use Your Information

2.1 Service Delivery

• Providing custody, settlement, and fund administration services
• Processing transactions and managing your accounts
• Executing corporate actions and distributing income payments
• Delivering regulatory reporting and compliance documentation
• Providing access to the Digital Platform and client support

2.2 Legal and Regulatory Compliance

• Know Your Customer (KYC) and Customer Due Diligence (CDD)
• Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF)
• FCA, PRA, HMRC, and ESMA regulatory requirements
• FATCA, CRS, and DAC6 tax reporting obligations
• AIFMD, UCITS, MiFID II, and EMIR regulatory reporting

2.3 Risk Management and Security

We use your information to verify identity, detect and prevent fraud, conduct sanctions screening and PEP checks, maintain platform security, and manage operational, credit, and market risk across our business.

3. Legal Basis for Processing

Under UK GDPR, we process your data under the following legal grounds:

• Contractual necessity — required to perform our custody services agreement
• Legal obligation — compliance with AML, KYC, and regulatory requirements
• Legitimate interests — risk management, fraud prevention, and system security
• Consent — where explicitly provided for specific processing activities

4. Information Sharing

4.1 Service Providers

We share data with sub-custodians, central securities depositories (Euroclear, Clearstream, CREST), payment systems (SWIFT, CHAPS), technology providers, professional advisors, and KYC/AML screening providers. All third parties operate under strict confidentiality obligations and data processing agreements.

4.2 Regulatory Disclosure

We disclose information to the FCA, PRA, HMRC, ESMA, and other financial regulators as required. We will never sell your personal data to third parties for commercial purposes.

5. International Transfers

As a global custody bank, we transfer personal data outside the UK to sub-custodians and CSDs in jurisdictions where your securities are held. All international transfers comply with UK GDPR through adequacy decisions, Standard Contractual Clauses, or other approved transfer mechanisms. A full list of transfer safeguards is available on request.

6. Data Retention

• Active relationships: Duration of the service agreement
• Transaction records: Minimum 7 years after transaction date
• KYC/AML records: Minimum 5 years after relationship termination
• Regulatory filings: 7–10 years as required by applicable regulation
• Legal claims: Until expiration of applicable limitation periods

7. Your Rights

Under UK GDPR, you have the following rights in relation to your personal information:

To exercise any right, contact our Data Protection Officer. Note that some rights are limited where we have overriding legal obligations to retain data.

8. Security Measures

We protect your information with AES-256 encryption at rest, TLS 1.3 in transit, multi-factor authentication with hardware token support, 24/7 Security Operations Centre monitoring, intrusion detection and prevention systems, ISO 27001 certification, and SOC 2 Type II compliance. All staff with data access undergo background checks and annual security training.

9. Cookies

Our Digital Platform uses strictly necessary cookies for session management, security cookies to prevent fraud and unauthorised access, and optional analytics cookies to improve platform performance. You can manage cookie preferences via your browser settings, though disabling functional cookies may limit Platform capability.

10. Policy Changes

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated by email to registered contacts, via a prominent notice on the Digital Platform, and by updating the effective date. Continued use of our services constitutes acceptance.

11. Contact Our DPO