Privacy & Data Policy

This notice covers personal information we collect through this website, including contact details submitted via enquiry forms, email links, newsletter sign-ups, and any information you choose to provide when requesting compliance services. It does not replace our internal AML/CTF and client due diligence policies, which govern how we handle information once you become a client.

This policy is designed to comply with and reflect:

• Data Protection Act, Chapter 22:04 of the Laws of Trinidad and Tobago ("the DPA") including the General Privacy Principles currently in force under Section 6 of the Act.
• Electronic Transactions Act, Chapter 22:02 ("the ETA") governing electronic records, website operations, and commercial communications.

This note applies to all personal information processed by SolveX, whether collected directly from data subjects or indirectly through third-party verification tools or business partners. It applies to all staff, contractors, and service providers acting on SolveX's behalf.

Where certain parts of the T&T DPA have not yet been fully proclaimed, this policy adopts the higher standard as a matter of corporate governance best practice and a forward-looking compliance posture.

SolveX operates in strict compliance with the primary data protection and electronic commerce statutes of Trinidad and Tobago:

• The Data Protection Act, Chapter 22:04: Is the primary data protection statute of Trinidad and Tobago. While it was partially proclaimed on 6 January 2012 by Legal Notice 2 of 2012, The General Privacy Principles under Section 6 are currently in force and govern all persons who handle, store, or process personal information. Its core operational and enforcement provisions including rules for processing personal data and the creation of an Information Commissioner remain unproclaimed and are not yet in force.
• Electronic Transactions, ETA Chapter 22:02: This framework governs the legitimacy of electronic transactions, electronic records management, and user consent constraints regarding electronic marketing and corporate communications.

SolveX Compliance is responsible for personal information collected through this website and acts as the organisation determining how and why that information is used. When we introduce you to banks, other financial institutions, or professional advisers, they will make their own decisions about your information and will provide their own privacy notices.

SolveX processes all personal information in accordance with the twelve General Privacy Principles currently in force under Section 6 of the DPA:

• Accountability: SolveX is responsible for all personal information under its control and designates a Privacy Lead / Compliance Officer accordingly.
• Purpose Identification: The purpose for which personal information is collected is identified before or at the time of collection.
• Knowledge & Consent: The knowledge and consent of the individual is required for the collection, use, or disclosure of personal information, except where otherwise permitted or required by law.
• Limited Collection: Collection is limited to what is necessary for the identified business purpose and is conducted through lawful means.
• Limited Use, Disclosure & Retention: Personal information is used only for the purpose for which it was collected and retained only for as long as necessary. Data is not disclosed for unrelated purposes without prior consent.
• Accuracy: Personal information is kept accurate, complete, and current as necessary for the identified purpose.
• Security Safeguards: Personal information is protected by technical, physical, and organisational controls appropriate to its sensitivity.
• Sensitive Information Protection: Sensitive personal information is protected from processing except where specifically permitted by written law or explicit consent.
• Openness: SolveX makes information about its policies and practices relating to the management of personal information available to data subjects upon request.
• Access: Upon request, SolveX discloses the existence, use, and disclosure of personal information, enabling individuals to review, challenge, and correct accuracy and completeness.
• Individual Challenges: Individuals may challenge SolveX's compliance with these principles and receive timely and appropriate engagement.
• Cross-Border Transfers: Personal information transferred outside Trinidad and Tobago is subject to comparable safeguards as required by Section 6(l) of the DPA.

Personal information is processed by SolveX on one or more of the following legal bases:

• Contractual Necessity: Performance of consultancy, advisory, and corporate support services as agreed with the client.
• Legitimate Interest: To effectively manage operational business risks, prevent fraud, secure our digital networks, and protect the professional reputation of SolveX.
• Consent: Where required for specific data sharing, enhanced background verification, or any processing not otherwise covered by contract or legitimate interest. Consent may be withdrawn at any time, but this does not affect lawful processing already undertaken prior to withdrawal.

6.1 Corporate & Business Information

• Company incorporation, registration documents, and annual returns
• Ownership, control, and structure charts
• Contracts, engagement letters, and operational evidence

6.2 Personal Information (Section 4, DPA)

In accordance with the definition of "personal information" under the DPA, SolveX collects:

• Full names, dates of birth, nationality, and marital status.
• Residential and correspondence addresses, email addresses, and telephone numbers.
• Government-issued identification numbers and verification documents.
• Professional history, resumes (CVs), and employment records.

6.3 Sensitive Personal Information (Section 4, DPA)

The following categories constitute sensitive personal information under the DPA and are processed strictly for specific advisory risk assessments and only to the extent permitted by law or explicit consent:

• Public background screenings and adverse media findings.
• Racial or ethnic origin (where incidentally visible on identification documents provided voluntarily by the client).

Consistent with Section 6 of the DPA, SolveX collects only personal information that is strictly necessary for one or more of the following identified purposes:

• Verifying client identity to establish consultancy agreements.
• Delivering advisory, strategic, and corporate liaison services.
• Ongoing monitoring and periodic review of business and client relationships.
• Managing website operations and handling user inquiries.

Personal information is not used for unsolicited marketing, profiling, or any commercial purpose unrelated to the delivery of agreed services.

SolveX implements technical and organisational safeguards appropriate to the sensitivity of the information processed, in compliance with the security principle under Section 6(g) of the DPA and in alignment with the Cybersecurity Framework promoted by the Ministry of Digital Transformation:

• Encrypted digital storage for all client and business files.
• Restricted access on a need-to-know basis via role-based access controls.
• Segregation of client files and confidential operational data.
• Secure document transfer protocols (encrypted communications channels).
• Multi-factor authentication (MFA) for systems holding personal information.
• Regular access reviews and mandatory staff confidentiality obligations.
• Physical security controls for any temporary hard-copy records.

Personal information may be shared, on a strictly need-to-know basis, with:

• Professional advisers including lawyers, accountants, and auditors engaged by SolveX.
• Law enforcement or regulatory authorities where legally compelled by a valid court order or statutory demand.
• Technology providers, IT support, and secure software vendors acting as data processors.

No personal information is sold, rented, or shared for third-party commercial exploitation.

9.1 Cross-Border Transfers

Transfers of personal information outside Trinidad and Tobago are conducted in accordance with Section 6(l) of the DPA. This requires that the laws of the recipient jurisdiction provide safeguards for personal information comparable to those under T&T law. Where such comparability cannot be confirmed, SolveX ensures that appropriate contractual or technical safeguards (such as standard data protection clauses) are put in place prior to the transfer.

We keep basic website enquiry records for as long as needed to respond to you and maintain a record of our communications, usually not longer than is reasonably necessary for our business purposes. If you become a client, we keep your compliance and onboarding records for the periods required under applicable anti-money laundering and regulatory rules, which may be at least five years from the end of the business relationship.

Under Section 6 of the DPA, data subjects have the following core rights:

• Access: The right to request disclosure of all personal information held about them, including its use and disclosure history (Section 6(j) of the DPA).
• Rectification: The right to request correction of inaccurate, outdated, or incomplete personal information.
• Erasure: The right to request deletion of personal information where there is no longer a valid contractual or lawful basis for continued processing.
• Restriction of Processing: The right to request that processing be limited to storage only, pending resolution of a dispute about data accuracy or lawful basis.
• Complaints: Complaints will be handled internally and if escalation is required, we will escalate to the various divisions (FIU, CBTT etc.) if necessary.

To exercise any right, data subjects should submit a written request to: compliance@solvexglobal.org. SolveX will respond within a reasonable timeframe, and in any event no later than 30 days from receipt.

Whilst the DPA does not yet contain express, proclaimed breach notification provisions, SolveX adopts best practices consistent with international governance standards:

• All suspected or actual data breaches are logged immediately in an internal Breach Register.
• A risk assessment is conducted to determine the scope, cause, and impact of the incident.
• The ICO-TT will be notified without undue delay where the breach is likely to cause material or reputational harm to data subjects.
• Affected individuals will be notified directly where the breach is likely to result in high risk to their rights and interests.
• Immediate corrective and technical mitigation measures are implemented and documented.

In accordance with best practice and the Electronic Transactions Act, Chapter 22:02, SolveX's website collects only such personal information as is voluntarily provided by visitors or as is technically necessary for the operation and security of the platform. Where the website uses cookies or analytical tools, users are informed and given a transparent mechanism to manage their preferences or opt-out.

SolveX does not engage in unsolicited commercial electronic communications. Where electronic marketing or corporate updates are distributed, SolveX complies with the opt-out requirements of Section 58 of the Electronic Transactions Act (Chap. 22:02) by providing an explicit, friction-free "unsubscribe" link, and obtains prior consent where necessary.